[*] Binary protection state of triggerd
Full RELRO Canary found NX disabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function printf tear down of triggerd
addiu sp, sp, -0x68
lw v0, 0x3c(a0)
sw s4, 0x50(sp)
lw s4, -0x7e50(gp)
sw gp, 0x18(sp)
sw s3, 0x4c(sp)
lw v1, (s4)
sw s2, 0x48(sp)
sw s1, 0x44(sp)
sw s0, 0x40(sp)
sw ra, 0x64(sp)
sw fp, 0x60(sp)
sw s7, 0x5c(sp)
sw s6, 0x58(sp)
sw s5, 0x54(sp)
move s0, a0
sw zero, 0x34(sp)
sw v1, 0x3c(sp)
lw s2, 0x28(a0)
lw s3, 0x14(a0)
bnez v0, 0x3430
lw s1, 0x2c(a0)
lw a1, -0x7fd8(gp)
addiu a1, a1, -0x441c
lw a0, -0x7fd8(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
jalr t9
addiu a0, a0, -0x4418
lw gp, 0x18(sp)
move a0, v0
move s5, v0
lw t9, -sym.imp.strlen(gp)
jalr t9
addiu s6, sp, 0x34
lw gp, 0x18(sp)
lw a0, 0x6c(s0)
move a3, s6
lw t9, -sym.imp.confutils_set_file_contents_with_sync(gp)
move a2, v0
jalr t9
move a1, s5
lw v0, 0x34(sp)
beqz v0, 0x343c
lw gp, 0x18(sp)
lw v1, 8(v0)
lw a3, -0x7fd8(gp)
--
addu v0, s3, s2
sltu s3, v0, s1
jalr t9
movz s1, v0, s3
lw gp, 0x18(sp)
lw a3, 0x40(s0)
move s3, s1
lw a2, -0x7fd8(gp)
lw a1, -0x7fd8(gp)
lw t9, -sym.imp.g_key_file_set_integer(gp)
addiu a2, a2, -0x43d0
addiu a1, a1, -0x43bc
move a0, v0
jalr t9
move s1, v0
beqz s3, 0x3538
lw gp, 0x18(sp)
lw s7, -0x7fd8(gp)
lw v1, -0x7fd8(gp)
lw fp, -0x7fd8(gp)
addiu v0, s7, -0x43b0
move s2, zero
addiu v1, v1, -0x43b4
addiu fp, fp, -0x43ac
sw v0, 0x24(sp)
lw t9, -sym.imp.g_strdup_printf(gp)
move a0, v1
sw v1, 0x2c(sp)
jalr t9
move a1, s2
lw a0, 0x38(s0)
sll t0, s2, 2
lw gp, 0x18(sp)
lwx a0, t0(a0)
lw t1, 0x5c(s0)
lw t9, -sym.imp.g_key_file_set_boolean_list(gp)
lw a3, 8(a0)
move a1, v0
sw t1, 0x10(sp)
sw t0, 0x28(sp)
move a2, fp
move a0, s1
jalr t9
move s7, v0
lw t0, 0x28(sp)
lw a3, 0x38(s0)
--
sll v1, v0, 2
lw v0, 8(a0)
addu v0, v0, v1
lw s7, (v0)
sw s5, (v0)
beq s7, s5, 0x3ed8
move fp, zero
beqz s5, 0x4310
lw t9, -sym.imp.g_strdup(gp)
lw a0, -0x7fd8(gp)
jalr t9
addiu a0, a0, -0x42a4
lw gp, 0x20(sp)
move fp, v0
beql fp, zero, 0x3ed8
move fp, zero
lw v0, 0x38(sp)
lw t9, -sym.imp.g_variant_ref(gp)
move a0, s6
jalr t9
sw v0, 0x28(sp)
lw gp, 0x20(sp)
lw s5, 0x78(s0)
move a2, s4
lw a0, -0x7fd8(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
move a1, s3
addiu a0, a0, -0x4274
sw s5, 0x34(sp)
jalr t9
sw v0, 0x2c(sp)
lw gp, 0x20(sp)
move a1, s1
move s7, v0
lw a0, -0x7fd8(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
jalr t9
addiu a0, a0, -0x43d4
lw gp, 0x20(sp)
addiu a0, zero, 0x14
lw t9, -sym.imp.g_malloc(gp)
jalr t9
sw v0, 0x30(sp)
lw gp, 0x20(sp)
move a0, s5
move a1, s7
lw t9, -sym.imp.g_hash_table_lookup(gp)
jalr t9
move s5, v0
move s6, v0
beqz v0, 0x4328
lw gp, 0x20(sp)
lw t9, -0x7cfc(gp)
jalr t9
move a0, s7
lw gp, 0x20(sp)
--
lw t9, -0x7cfc(gp)
lwx v0, a0(v0)
jalr t9
lw a0, 4(v0)
lw v0, 0x38(sp)
lw gp, 0x20(sp)
lw s5, 0x38(s0)
sll v0, v0, 2
lw t9, -sym.imp.g_strdup(gp)
lwx s5, v0(s5)
jalr t9
move a0, s7
lw gp, 0x20(sp)
bnez fp, 0x4130
sw v0, 4(s5)
b 0x3ed8
move fp, zero
lw t9, -sym.imp.g_variant_get_int32(gp)
jalr t9
move a0, s6
lw v1, 0x40(s0)
lw gp, 0x20(sp)
beq v0, v1, 0x42cc
sw v0, 0x40(s0)
lw a0, -0x7fd8(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
move a1, v0
jalr t9
addiu a0, a0, -0x43b4
move fp, v0
b 0x4128
lw gp, 0x20(sp)
lw a0, -0x7fd8(gp)
jalr t9
addiu a0, a0, -0x429c
move fp, v0
b 0x4128
lw gp, 0x20(sp)
lw a3, -0x7fd0(gp)
lw t9, -sym.imp.g_hash_table_new_full(gp)
lw a2, -0x7cfc(gp)
lw a1, -0x7f4c(gp)
lw a0, -0x7d10(gp)
jalr t9
addiu a3, a3, 0x31e0
lw gp, 0x20(sp)
--
lw gp, 0x20(sp)
lwx v0, s6(v0)
lw t9, -0x7cfc(gp)
jalr t9
lw a0, 4(v0)
lw gp, 0x20(sp)
lw v0, 0x38(fp)
lw a2, 0x38(sp)
lw t9, -sym.imp.g_key_file_get_string(gp)
lwx s7, s6(v0)
move a0, s4
move a3, s3
jalr t9
move a1, s5
lw a0, 0x48(sp)
lw gp, 0x20(sp)
bnez a0, 0x5c6c
sw v0, 4(s7)
lw t9, -0x7cfc(gp)
jalr t9
move a0, s5
lw v0, 0x3c(sp)
addiu s2, s2, 1
beq v0, s2, 0x5c0c
lw gp, 0x20(sp)
lw t9, -sym.imp.g_strdup_printf(gp)
lw a0, 0x30(sp)
jalr t9
move a1, s2
lw gp, 0x20(sp)
lw a2, 0x34(sp)
move a0, s4
lw t9, -sym.imp.g_key_file_get_boolean_list(gp)
sw s3, 0x10(sp)
move a3, s1
move a1, v0
jalr t9
move s5, v0
lw a0, 0x48(sp)
lw gp, 0x20(sp)
beqz a0, 0x5a44
move s7, v0
lw a3, -0x7fd8(gp)
lw a2, -0x7fd8(gp)
lw v0, 8(a0)
lw t9, -sym.imp.g_log(gp)
--
bal 0x3d84
move a0, s0
beqz s4, 0x63bc
lw gp, 0x18(sp)
lw v0, -0x7fd8(gp)
lw fp, -0x7fd8(gp)
sw v0, 0x24(sp)
lw v0, -0x7fd8(gp)
lw s7, -0x7fd8(gp)
sw v0, 0x28(sp)
addiu v0, s1, -0x3e6c
sw v0, 0x2c(sp)
lw v0, -0x7fd8(gp)
lw s6, -0x7fd8(gp)
addiu v0, v0, -0x3e44
sw v0, 0x30(sp)
lw v0, -0x7fd8(gp)
addiu v0, v0, -0x4320
sw v0, 0x34(sp)
lw v0, -0x7fd8(gp)
addiu v0, v0, -0x4314
sw v0, 0x38(sp)
lw v0, -0x7fd8(gp)
addiu v0, v0, -0x4304
sw v0, 0x3c(sp)
lw t9, -sym.imp.g_strdup_printf(gp)
lw a1, 0x2c(sp)
lw a0, 0x30(sp)
jalr t9
move a2, s5
lw gp, 0x18(sp)
addiu a0, zero, 1
move s1, v0
lw t9, -sym.imp.g_variant_new_boolean(gp)
jalr t9
addiu s5, s5, 1
lw a3, 0x34(sp)
move a2, s2
move a1, s1
sw v0, 0x10(sp)
move t9, s3
bal 0x3d84
move a0, s0
lw gp, 0x18(sp)
lw t9, -sym.imp.g_variant_new_boolean(gp)
jalr t9
--
jalr t9
move a0, s1
lw v0, 0x18(s0)
beqz v0, 0x6ca8
lw gp, 0x20(sp)
lw a0, 0x28(s0)
lw t9, -sym.imp.g_malloc0(gp)
jalr t9
sll a0, a0, 2
lw v1, 0x28(s0)
lw gp, 0x20(sp)
beqz v1, 0x6c64
sw v0, 0x38(s0)
lw s4, -0x7fd8(gp)
move s1, zero
addiu s5, s5, -0x3e6c
addiu s4, s4, -0x3e44
b 0x6ba0
addiu s3, s3, -0x302c
jalr t9
nop
lw v0, 0x28(s0)
sltu v0, s1, v0
beqz v0, 0x6c64
lw gp, 0x20(sp)
lw t9, -sym.imp.g_strdup_printf(gp)
move a2, s1
move a1, s5
jalr t9
move a0, s4
lw v1, 0x18(s0)
lw gp, 0x20(sp)
move s2, v0
lw v0, 8(v1)
lw s6, 0x38(s0)
lw a0, 0x10(s0)
lw a2, (v0)
lw t9, -sym.imp.g_dbus_connection_register_object(gp)
sll v0, s1, 2
move a3, s3
move a1, s2
sw zero, 0x18(sp)
sw zero, 0x14(sp)
sw s0, 0x10(sp)
jalr t9
addu s6, s6, v0
--
sw s1, 0x20(sp)
sw a0, 0x30(sp)
sw s2, 0x24(sp)
sw s0, 0x1c(sp)
bal sym.io_trigger_get_type
nop
lw gp, 0x10(sp)
lw a0, 0x30(sp)
lw t9, -sym.imp.g_type_check_instance_cast(gp)
jalr t9
move a1, v0
lw gp, 0x10(sp)
move s1, v0
lw t9, -sym.imp.g_string_new(gp)
jalr t9
move a0, zero
lw v1, 0x1c(s1)
lw gp, 0x10(sp)
beqz v1, 0x72a0
move s3, v0
lw s2, -0x7fd8(gp)
move s0, zero
addiu s2, s2, -0x39e0
lw a3, 0x20(s1)
sll v0, s0, 2
lw t9, -sym.imp.g_string_append_printf(gp)
lwx a3, v0(a3)
move a2, s0
sltu a3, zero, a3
move a1, s2
jalr t9
move a0, s3
lw v0, 0x1c(s1)
addiu s0, s0, 1
sltu v0, s0, v0
bnez v0, 0x7268
lw gp, 0x10(sp)
lw ra, 0x2c(sp)
move v0, s3
lw s2, 0x24(sp)
lw s3, 0x28(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 2
--
sw s1, 0x20(sp)
sw a0, 0x30(sp)
sw s2, 0x24(sp)
sw s0, 0x1c(sp)
bal sym.audio_trigger_get_type
nop
lw gp, 0x10(sp)
lw a0, 0x30(sp)
lw t9, -sym.imp.g_type_check_instance_cast(gp)
jalr t9
move a1, v0
lw gp, 0x10(sp)
move s1, v0
lw t9, -sym.imp.g_string_new(gp)
jalr t9
move a0, zero
lw v1, 0x1c(s1)
lw gp, 0x10(sp)
beqz v1, 0x7a60
move s3, v0
lw s2, -0x7fd8(gp)
move s0, zero
addiu s2, s2, -0x3988
lw a3, 0x20(s1)
sll v0, s0, 2
lw t9, -sym.imp.g_string_append_printf(gp)
lwx a3, v0(a3)
move a2, s0
sltu a3, zero, a3
move a1, s2
jalr t9
move a0, s3
lw v0, 0x1c(s1)
addiu s0, s0, 1
sltu v0, s0, v0
bnez v0, 0x7a28
lw gp, 0x10(sp)
lw ra, 0x2c(sp)
move v0, s3
lw s2, 0x24(sp)
lw s3, 0x28(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 2
--
lw gp, 0x10(sp)
addiu s7, sp, 0x24
addiu s6, sp, 0x28
lw s4, -0x7fd8(gp)
addiu s4, s4, -0x3888
lw t9, -sym.imp.g_hash_table_iter_next(gp)
move a2, s7
move a1, s6
jalr t9
move a0, s1
beqz v0, 0x85ac
lw gp, 0x10(sp)
lw v0, 0x28(sp)
beqz v0, 0x8528
lw t9, -sym.imp.g_hash_table_iter_next(gp)
lw a0, 0x28(s0)
bnez a0, 0x8570
lw v1, 0x24(sp)
lw a0, 0x24(s0)
beql a0, s2, 0x8574
lw a3, 8(v1)
lw a0, (v1)
bne a0, s2, 0x852c
move a2, s7
lw a3, 8(v1)
lw t9, -sym.imp.g_string_append_printf(gp)
lw a2, (v0)
sltu a3, zero, a3
move a1, s4
jalr t9
move a0, s3
lw gp, 0x10(sp)
move a2, s7
move a1, s6
lw t9, -sym.imp.g_hash_table_iter_next(gp)
jalr t9
move a0, s1
bnez v0, 0x8540
lw gp, 0x10(sp)
lw a0, 0x44(sp)
lw v1, (s5)
bne a0, v1, 0x85e8
move v0, s3
lw ra, 0x6c(sp)
lw s7, 0x68(sp)
lw s6, 0x64(sp)
--
move s3, v0
lw t9, -sym.imp.g_hash_table_iter_init(gp)
addiu s1, sp, 0x2c
jalr t9
move a0, s1
lw gp, 0x10(sp)
addiu s7, sp, 0x24
addiu s6, sp, 0x28
lw s4, -0x7fd8(gp)
addiu s4, s4, -0x36f8
lw t9, -sym.imp.g_hash_table_iter_next(gp)
move a2, s7
move a1, s6
jalr t9
move a0, s1
beqz v0, 0x9980
lw gp, 0x10(sp)
lw v0, 0x28(sp)
beqz v0, 0x9900
lw t9, -sym.imp.g_hash_table_iter_next(gp)
lw a0, 0x48(s0)
bnez a0, 0x9948
lw v1, 0x24(sp)
lw a0, 0x44(s0)
beq a0, s2, 0x994c
lw t9, -sym.imp.g_string_append_printf(gp)
lw a0, (v1)
bne a0, s2, 0x9900
lw t9, -sym.imp.g_hash_table_iter_next(gp)
lw t9, -sym.imp.g_string_append_printf(gp)
lw a2, (v0)
lw a3, 0xc(v1)
move a1, s4
jalr t9
move a0, s3
lw gp, 0x10(sp)
move a2, s7
move a1, s6
lw t9, -sym.imp.g_hash_table_iter_next(gp)
jalr t9
move a0, s1
bnez v0, 0x9918
lw gp, 0x10(sp)
lw a0, 0x44(sp)
lw v1, (s5)
bne a0, v1, 0x99bc
move v0, s3
lw ra, 0x6c(sp)
lw s7, 0x68(sp)
lw s6, 0x64(sp)
--
move s1, v0
lw t9, -sym.imp.g_string_new(gp)
jalr t9
move a0, zero
lw v1, 0x1c(s1)
move s2, v0
sltu v0, s0, v1
bnez v0, 0x9fe0
lw gp, 0x10(sp)
beq v1, s0, 0x9f78
nop
lw ra, 0x2c(sp)
move v0, s2
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x30
beqz v1, 0x9f58
lw s3, -0x7fd8(gp)
move s0, zero
addiu s3, s3, -0x36d4
lw a3, 0x20(s1)
sll v0, s0, 2
lw t9, -sym.imp.g_string_append_printf(gp)
lwx a3, v0(a3)
move a2, s0
sltu a3, zero, a3
move a1, s3
jalr t9
move a0, s2
lw v1, 0x1c(s1)
addiu s0, s0, 1
sltu v1, s0, v1
bnez v1, 0x9f88
lw gp, 0x10(sp)
lw ra, 0x2c(sp)
move v0, s2
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x30
lw a3, 0x20(s1)
sll v0, s0, 2
lw a1, -0x7fd8(gp)
lwx a3, v0(a3)
lw t9, -sym.imp.g_string_append_printf(gp)
move a2, s0
move a0, s2
sltu a3, zero, a3
jalr t9
addiu a1, a1, -0x36d4
lw ra, 0x2c(sp)
move v0, s2
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 2
addiu gp, gp, -0x5018
addu gp, gp, t9
addiu sp, sp, -0x28
lw t9, -sym.video_connected_trigger_get_type(gp)
sw gp, 0x10(sp)
sw ra, 0x24(sp)
--
move s1, v0
lw t9, -sym.imp.g_string_new(gp)
jalr t9
move a0, zero
lw s0, 0x1c(s1)
lw gp, 0x10(sp)
bnez s0, 0xa93c
move s2, v0
lw v0, 0x20(s1)
sltu v1, s3, v0
bnel v1, zero, 0xa8f8
lw a3, 0x24(s1)
beq v0, s3, 0xa97c
nop
lw ra, 0x2c(sp)
move v0, s2
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x30
sll v0, s3, 2
lw a1, -0x7fd8(gp)
lwx a3, v0(a3)
lw t9, -sym.imp.g_string_append_printf(gp)
move a2, s3
move a0, s2
sltu a3, zero, a3
jalr t9
addiu a1, a1, -0x3650
lw ra, 0x2c(sp)
move v0, s2
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x30
lw v0, 0x24(s1)
lw a1, -0x7fd8(gp)
lw t9, -sym.imp.g_string_append_printf(gp)
lw a2, (v0)
move a0, s2
addiu a1, a1, -0x3658
jalr t9
sltu a2, zero, a2
lw ra, 0x2c(sp)
move v0, s2
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x30
beqz v0, 0xa8d8
lw s3, -0x7fd8(gp)
addiu s3, s3, -0x3650
lw a3, 0x24(s1)
sll v0, s0, 2
lw t9, -sym.imp.g_string_append_printf(gp)
lwx a3, v0(a3)
move a2, s0
slt a3, zero, a3
move a1, s3
jalr t9
move a0, s2
lw v1, 0x20(s1)
addiu s0, s0, 1
sltu v1, s0, v1
bnez v1, 0xa988
lw gp, 0x10(sp)
lw ra, 0x2c(sp)
move v0, s2
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 2
[*] Function printf used 18 times triggerd
