[*] Binary protection state of dbox
Full RELRO Canary found NX disabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function printf tear down of dbox
lw gp, 0x18(sp)
addiu a0, v0, 1
sw a0, 0x40(sp)
lb v1, (a0)
move v0, a0
sll v1, v1, 1
addu v1, a1, v1
lhu v1, (v1)
andi v1, v1, 0x800
bnez v1, 0x8248
addiu a0, a0, 1
addiu v1, v0, 1
sltu a0, v1, s1
beqz a0, 0x8294
sw v1, 0x40(sp)
addiu fp, fp, 1
slt a0, s7, fp
bnel a0, zero, 0x8298
lw s1, 0x30(sp)
b 0x81cc
lb a0, 1(v0)
lw s1, 0x30(sp)
beqz s1, 0x7f94
lw a2, -0x7fdc(gp)
lw v0, 0x34(sp)
lw t9, -sym.imp.snprintf(gp)
addiu a1, zero, 0x64
addiu a2, a2, 0x55e8
subu a1, a1, v0
jalr t9
addu a0, s3, v0
lw gp, 0x18(sp)
lw a0, 0x24(sp)
move a2, s1
lw t9, -sym.tar_addfile(gp)
bal sym.tar_addfile
move a1, s3
lw gp, 0x18(sp)
lw a0, 0x4c(sp)
lw t9, -sym.safe_copyfd(gp)
bal sym.safe_copyfd
lw a1, 0xa4(sp)
move s4, v0
beq v0, s1, 0x83f4
lw gp, 0x18(sp)
lw s1, -0x7d38(gp)
--
lw a0, 0x4c(sp)
bal sym.safe_copyfd
lw a1, -0x6970(s4)
lw gp, 0x18(sp)
lw a0, (s1)
lw t9, -sym.imp.fileno(gp)
jalr t9
lw s1, 0x44(sp)
lw gp, 0x18(sp)
move a1, v0
lw t9, -sym.safe_copyfd(gp)
bal sym.safe_copyfd
move a0, s1
lw gp, 0x18(sp)
lw t9, -sym.tar_fakewrite(gp)
lw a1, 0x30(sp)
lw a0, 0x24(sp)
bal sym.tar_fakewrite
addiu s1, zero, 1
b 0x7fb0
lw gp, 0x18(sp)
beqz s1, 0x8018
lw t9, -sym.imp.close(gp)
lw a2, -0x7fdc(gp)
lw v0, 0x34(sp)
lw t9, -sym.imp.snprintf(gp)
addiu a1, zero, 0x64
addiu a2, a2, 0x5630
subu a1, a1, v0
jalr t9
addu a0, s3, v0
lw gp, 0x18(sp)
lw a3, 0xa4(sp)
lw a0, 0x24(sp)
lw t9, -sym.proc_append_fdmap(gp)
move a2, s0
bal sym.proc_append_fdmap
move a1, s3
b 0x8014
lw gp, 0x18(sp)
b 0x838c
lw s4, -0x7fb8(gp)
addiu v0, zero, 0x5a
move s7, zero
sw v0, 0x20(sp)
move fp, s3
--
lw a0, segment.INTERP(sp)
lw v1, (v0)
bne a0, v1, 0x97b8
move v0, s1
lw ra, 0x19c(sp)
lw fp, 0x198(sp)
lw s7, 0x194(sp)
lw s6, 0x190(sp)
lw s5, 0x18c(sp)
lw s4, 0x188(sp)
lw s3, segment.NOTE(sp)
lw s2, 0x180(sp)
lw s1, 0x17c(sp)
lw s0, 0x178(sp)
jr ra
addiu sp, sp, 0x1a0
lw t9, -sym.imp.strtoul(gp)
addiu a2, zero, 0x10
move a1, zero
jalr t9
addiu a0, sp, 0xc6
lw gp, 0x28(sp)
move a1, s3
move a0, s2
lw a2, -0x7fdc(gp)
lw t9, -sym.imp.snprintf(gp)
addiu a2, a2, 0x56d8
jalr t9
move s4, v0
lw gp, 0x28(sp)
addiu v0, sp, 0x9a
addiu s7, sp, 0x7a
lw s5, -0x7fdc(gp)
sw v0, 0x30(sp)
addiu s1, zero, 1
addiu s6, sp, 0x54
addiu s5, s5, 0x56dc
lwl a3, 3(s7)
lwl v0, 7(s7)
lw t9, -sym.imp.strtoul(gp)
lwr a3, (s7)
lwr v0, 4(s7)
sw a3, (s6)
addiu a2, zero, 0x10
move a1, zero
move a0, s6
--
move s1, v0
lw v0, 0x2c(s0)
slt v0, s1, v0
beqz v0, 0xed98
lw ra, 0x2c(sp)
lw t9, (s0)
beqz t9, 0xed9c
move v0, s1
lw a1, 0x28(s0)
lw a0, 8(s0)
jalr t9
move a2, s1
lw ra, 0x2c(sp)
move v0, s1
lw s0, 0x24(sp)
lw s1, 0x28(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 2
addiu gp, gp, 0x22c4
addu gp, gp, t9
addiu sp, sp, -0x28
addiu v0, sp, 0x30
sw s0, 0x20(sp)
lw s0, -0x7d68(gp)
lw t9, -sym.strace_vprintf(gp)
sw gp, 0x10(sp)
lw v1, (s0)
sw ra, 0x24(sp)
sw a2, 0x30(sp)
sw v1, 0x1c(sp)
sw a3, 0x34(sp)
sw v0, 0x18(sp)
bal sym.strace_vprintf
move a2, v0
lw a0, 0x1c(sp)
lw v1, (s0)
bne a0, v1, 0xee10
lw gp, 0x10(sp)
lw ra, 0x24(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x28
lw t9, -sym.imp.__stack_chk_fail(gp)
jalr t9
nop
--
sw s2, 0x1038(sp)
sw s1, 0x1034(sp)
move s0, a0
sw v1, 0x102c(sp)
lw a1, 0x18(a0)
beq s5, v0, 0xefc8
lw a2, 0x1c(a0)
lw t9, -0x7fdc(gp)
addiu t9, t9, -0x1330
bal 0xecd0
move a0, s5
addiu s1, zero, 0x288
mul v0, v0, s1
lw gp, 0x18(sp)
lw t9, -sym.proc_fdlist(gp)
lw s1, (a3)
addiu s2, sp, 0x2c
addiu a2, zero, 0x400
move a1, s2
move a0, s5
bal sym.proc_fdlist
addu s1, s1, v0
lw gp, 0x18(sp)
move s3, v0
sw v0, 0x10(sp)
lw s4, -sym.strace_printf(gp)
lw a1, -0x7fdc(gp)
move a3, s1
move a2, s5
addiu a1, a1, 0x5dd4
move t9, s4
bal sym.strace_printf
move a0, s0
beqz s3, 0xef84
lw gp, 0x18(sp)
lw s7, -0x7fdc(gp)
lw s6, -0x7fdc(gp)
sll s3, s3, 2
addu fp, s2, s3
addiu s7, s7, 0x5dec
move s3, zero
addiu s6, s6, 0x55e4
lw a2, (s2)
move a1, s7
move t9, s4
bal sym.strace_printf
--
sw zero, 0x10(sp)
move a3, zero
addiu a2, zero, 1
bal sym.strace_exit
move a1, s1
lw gp, 0x20(sp)
b 0xf5cc
lw a0, 0x18(s5)
lw a2, 0x1c(s5)
lw t9, 0x28(sp)
move a1, a0
jalr t9
move a0, s1
addiu s6, zero, 0x288
lw gp, 0x20(sp)
mul v1, v0, s6
lw a1, 0xc(s5)
lw t9, -sym.signal_map_sig2name(gp)
move a0, s4
lw a1, (a1)
bal sym.signal_map_sig2name
addu s6, v1, a1
lw gp, 0x20(sp)
sw v0, 0x14(sp)
lw v0, 0x3c(sp)
lw t9, -sym.strace_printf(gp)
move a0, s5
sw s4, 0x10(sp)
move a3, s6
move a2, s1
bal sym.strace_printf
addiu a1, v0, 0x5e3c
lw gp, 0x20(sp)
b 0xf5cc
lw a0, 0x18(s5)
mul s6, s3, a0
lw s7, 0xc(s5)
lw a3, 0x28(s5)
lw a0, 0x2c(s5)
lw s4, (s7)
addu s4, s4, s6
addiu t1, s4, 0x28
lbu v0, 0x20(s4)
andi v0, v0, 1
beqz v0, 0xf964
addiu t2, s4, 0x158
--
move s1, a1
move s2, a2
lw a0, 0x70(sp)
lw s3, 0x74(sp)
lw s4, 0x78(sp)
lw s5, 0x7c(sp)
lw s6, 0x80(sp)
beqz v0, 0x10288
lw s7, 0x84(sp)
lw v0, -0x7fdc(gp)
sll v1, a3, 2
addiu v0, v0, 0x6140
lwx v0, v1(v0)
addu v0, v0, gp
jr v0
nop
lw t9, -0x7fdc(gp)
move a3, a0
addiu t9, t9, -0x268
bal 0xfd98
move a0, fp
lw gp, 0x30(sp)
subu a1, s2, v0
addu a0, s1, v0
lw a2, -0x7fdc(gp)
lw t9, -sym.imp.snprintf(gp)
addiu a2, a2, 0x6014
jalr t9
move s0, v0
lw gp, 0x30(sp)
addiu s0, s0, 2
sw s4, 0x18(sp)
lw v0, -0x7fdc(gp)
lw t9, -sym.imp.__snprintf_chk(gp)
sw s3, 0x14(sp)
addiu v0, v0, 0x5e90
sw v0, 0x10(sp)
addiu a3, zero, -1
addiu a2, zero, 1
subu a1, s2, s0
jalr t9
addu a0, s1, s0
addu v0, s0, v0
lw ra, 0x5c(sp)
lw fp, 0x58(sp)
lw s7, 0x54(sp)
--
lw s0, 0x38(sp)
jr ra
addiu sp, sp, 0x60
lw t9, -0x7fdc(gp)
move a3, a0
addiu t9, t9, -0x268
bal 0xfd98
move a0, fp
lw gp, 0x30(sp)
move s0, v0
sw s4, 0x18(sp)
lw v0, -0x7fdc(gp)
lw t9, -sym.imp.__snprintf_chk(gp)
sw s3, 0x14(sp)
b 0xff68
addiu v0, v0, 0x5ec0
lw t9, -0x7fdc(gp)
move a3, a0
addiu t9, t9, -0x268
bal 0xfd98
move a0, fp
lw gp, 0x30(sp)
subu a1, s2, v0
addu a0, s1, v0
lw a2, -0x7fdc(gp)
lw t9, -sym.imp.snprintf(gp)
addiu a2, a2, 0x6014
jalr t9
move s0, v0
lw gp, 0x30(sp)
addiu s0, s0, 2
subu a2, s2, s0
lw t9, -0x7fdc(gp)
addu a1, s1, s0
addiu t9, t9, -0x50c
move a3, s3
move a0, fp
bal 0xfaf4
sw s4, 0x10(sp)
lw gp, 0x30(sp)
addu s0, s0, v0
sw s7, 0x20(sp)
lw v0, -0x7fdc(gp)
lw t9, -sym.imp.__snprintf_chk(gp)
sw s6, 0x1c(sp)
sw s5, 0x18(sp)
--
addiu a3, zero, -1
jalr t9
addiu a2, zero, 1
lw ra, 0x5c(sp)
addu v0, s0, v0
lw fp, 0x58(sp)
lw s7, 0x54(sp)
lw s6, 0x50(sp)
lw s5, 0x4c(sp)
lw s4, 0x48(sp)
lw s3, 0x44(sp)
lw s2, 0x40(sp)
lw s1, 0x3c(sp)
lw s0, 0x38(sp)
jr ra
addiu sp, sp, 0x60
lw t9, -0x7fdc(gp)
move a3, a0
addiu t9, t9, -0x268
bal 0xfd98
move a0, fp
lw gp, 0x30(sp)
subu a1, s2, v0
addu a0, s1, v0
lw a2, -0x7fdc(gp)
lw t9, -sym.imp.snprintf(gp)
addiu a2, a2, 0x6014
jalr t9
move s0, v0
lw gp, 0x30(sp)
addiu s0, s0, 2
subu a2, s2, s0
lw t9, -0x7fdc(gp)
addu a1, s1, s0
move a3, s3
move a0, fp
addiu t9, t9, -0x50c
bal 0xfaf4
sw s4, 0x10(sp)
lw gp, 0x30(sp)
addu s0, s0, v0
sw s7, 0x1c(sp)
lw v0, -0x7fdc(gp)
lw t9, -sym.imp.__snprintf_chk(gp)
addiu v0, v0, 0x5e9c
sw s6, 0x18(sp)
--
bal 0xfd98
move a0, fp
lw gp, 0x30(sp)
move s0, v0
sw s3, 0x14(sp)
lw v0, -0x7fdc(gp)
lw t9, -sym.imp.__snprintf_chk(gp)
addiu v0, v0, 0x6074
sw v0, 0x10(sp)
addiu a3, zero, -1
addiu a2, zero, 1
subu a1, s2, s0
jalr t9
addu a0, s1, s0
b 0xff84
addu v0, s0, v0
lw t9, -0x7fdc(gp)
move a3, a0
addiu t9, t9, -0x268
bal 0xfd98
move a0, fp
lw gp, 0x30(sp)
subu a1, s2, v0
addu a0, s1, v0
lw a2, -0x7fdc(gp)
lw t9, -sym.imp.snprintf(gp)
addiu a2, a2, 0x6014
jalr t9
move s0, v0
lw gp, 0x30(sp)
addiu s0, s0, 2
sw s6, 0x20(sp)
lw v0, -0x7fdc(gp)
lw t9, -sym.imp.__snprintf_chk(gp)
sw s5, 0x1c(sp)
sw s4, 0x18(sp)
sw s3, 0x14(sp)
b 0x10068
addiu v0, v0, 0x5ee0
lw t9, -0x7fdc(gp)
move a3, a0
addiu t9, t9, -0x268
bal 0xfd98
move a0, fp
lw gp, 0x30(sp)
move s0, v0
--
sw v0, 0x14(sp)
lw v0, -0x7fdc(gp)
b 0x10638
addiu v0, v0, 0x6048
lw v0, 0x4c(sp)
lw t9, -sym.imp.__snprintf_chk(gp)
sw v0, 0x1c(sp)
lw v0, 0x48(sp)
sw v0, 0x18(sp)
lw v0, 0x44(sp)
sw v0, 0x14(sp)
lw v0, -0x7fdc(gp)
b 0x106d4
addiu v0, v0, 0x6068
lw t9, -0x7fdc(gp)
lw a3, 0x44(sp)
subu a2, s3, s0
addu a1, s2, s0
addiu t9, t9, -0x268
bal 0xfd98
move a0, s1
lw gp, 0x30(sp)
addu s0, v0, s0
subu a1, s3, s0
lw a2, -0x7fdc(gp)
lw t9, -sym.imp.snprintf(gp)
addu a0, s2, s0
jalr t9
addiu a2, a2, 0x5ecc
addiu s0, s0, 1
beqz s5, 0x10588
lw gp, 0x30(sp)
b 0x105b8
nop
lw t9, -0x7fdc(gp)
lw a3, 0x44(sp)
subu a2, s3, s0
addu a1, s2, s0
addiu t9, t9, -0x268
bal 0xfd98
move a0, s1
lw gp, 0x30(sp)
addu s0, v0, s0
subu a1, s3, s0
lw a2, -0x7fdc(gp)
lw t9, -sym.imp.snprintf(gp)
addu a0, s2, s0
jalr t9
addiu a2, a2, 0x6014
lw gp, 0x30(sp)
lw v0, 0x4c(sp)
addiu s0, s0, 2
lw t9, -0x7fdc(gp)
lw a3, 0x48(sp)
subu a2, s3, s0
addu a1, s2, s0
addiu t9, t9, -0x50c
move a0, s1
bal 0xfaf4
sw v0, 0x10(sp)
lw gp, 0x30(sp)
addu s0, s0, v0
lw v0, 0x4c(sp)
lw t9, -sym.imp.__snprintf_chk(gp)
sw v0, 0x14(sp)
lw v0, -0x7fdc(gp)
b 0x10638
addiu v0, v0, 0x6074
lw t9, -0x7fdc(gp)
lw a3, 0x44(sp)
subu a2, s3, s0
addu a1, s2, s0
addiu t9, t9, -0x268
bal 0xfd98
move a0, s1
lw gp, 0x30(sp)
addu s0, v0, s0
addiu s7, s0, 2
lw a2, -0x7fdc(gp)
lw t9, -sym.imp.snprintf(gp)
subu a1, s3, s0
addu a0, s2, s0
jalr t9
addiu a2, a2, 0x6014
lw gp, 0x30(sp)
addu a0, s2, s7
bnez s5, 0x10e14
subu a1, s3, s7
bgtz s6, 0x10eac
lw t9, -sym.imp.__snprintf_chk(gp)
lw v0, 0x48(sp)
sw v0, 0x14(sp)
lw v0, -0x7fdc(gp)
addiu a3, zero, -1
addiu v0, v0, 0x6090
addiu a2, zero, 1
jalr t9
sw v0, 0x10(sp)
lw gp, 0x30(sp)
addu s0, s7, v0
[*] Function printf used 22 times dbox
