[*] Binary protection state of param_upgrader

  
  	Full RELRO     Canary found      NX disabled  PIE enabled  No RPATH     No RUNPATH   No Symbols


[*] Function printf tear down of param_upgrader

jalr t9
lw a0, 4(s0)
lw gp, 0x10(sp)
lw t9, -sym.imp.g_main_loop_unref(gp)
jalr t9
lw a0, 8(s0)
lw gp, 0x10(sp)
lw ra, 0x1c(sp)
move a1, s0
lw t9, -sym.imp.g_slice_free1(gp)
lw s0, 0x18(sp)
addiu a0, zero, 0xc
jr t9
addiu sp, sp, 0x20
nop
nop
lui gp, 2
addiu gp, gp, -0x3c90
addu gp, gp, t9
addiu sp, sp, -0x30
lw a3, 4(a1)
sw s1, 0x28(sp)
move s1, a0
lw a0, -0x7fc0(gp)
lw a2, 8(a1)
lw t9, -sym.imp.g_strdup_printf(gp)
lw a1, (a1)
sw ra, 0x2c(sp)
sw s0, 0x24(sp)
sw gp, 0x10(sp)
jalr t9
addiu a0, a0, str._s:_s:_s
lw gp, 0x10(sp)
move a1, v0
move a0, s1
lw t9, -sym.imp.g_hash_table_lookup(gp)
jalr t9
move s0, v0
lw gp, 0x10(sp)
sw v0, 0x1c(sp)
lw t9, -0x7e20(gp)
jalr t9
move a0, s0
lw ra, 0x2c(sp)
lw v0, 0x1c(sp)
lw s1, 0x28(sp)
--
jr ra
addiu sp, sp, 0x40
lw a3, -0x7fc0(gp)
lw a2, -0x7fc0(gp)
lw t9, -sym.imp.g_log(gp)
sw s3, 0x10(sp)
addiu a3, a3, 0x65b4
addiu a2, a2, str._sNo_proxy_found_for_param__s
addiu a1, zero, 0x10
jalr t9
move a0, zero
lw ra, 0x3c(sp)
move s0, zero
move v0, s0
lw s4, 0x38(sp)
lw s3, 0x34(sp)
lw s2, 0x30(sp)
lw s1, 0x2c(sp)
lw s0, 0x28(sp)
jr ra
addiu sp, sp, 0x40
lui gp, 2
addiu gp, gp, -0x405c
addu gp, gp, t9
addiu sp, sp, -0x48
lw t9, -sym.imp.g_strdup_printf(gp)
sw s0, 0x2c(sp)
move s0, a1
sw s3, 0x38(sp)
move s3, a0
lw a0, -0x7fc0(gp)
sw s5, 0x40(sp)
sw s4, 0x3c(sp)
lw a1, (a1)
move s4, a2
move s5, a3
lw a2, 8(s0)
lw a3, 4(s0)
sw gp, 0x20(sp)
sw ra, 0x44(sp)
sw s2, 0x34(sp)
sw s1, 0x30(sp)
jalr t9
addiu a0, a0, str._s:_s:_s
lw gp, 0x20(sp)
move a1, v0
--
addiu a3, a3, 0x65b4
addiu a2, a2, str._sAll_properties_handled_for__s:_s:_s
addiu a1, zero, 0x40
jalr t9
move a0, zero
lw ra, 0x34(sp)
lw s1, 0x30(sp)
lw s0, 0x2c(sp)
jr ra
addiu sp, sp, 0x38
jr ra
nop
lui gp, 2
addiu gp, gp, -0x48e4
addu gp, gp, t9
beqz a0, 0x4180
lw t9, -sym.imp.g_object_unref(gp)
jr t9
nop
jr ra
nop
lui gp, 2
addiu gp, gp, -0x4908
addu gp, gp, t9
addiu sp, sp, -0x38
lw t9, -sym.imp.g_strdup_printf(gp)
sw s2, 0x30(sp)
move s2, a0
lw a0, -0x7fc0(gp)
lw a3, 4(a1)
lw a2, 8(a1)
sw s0, 0x28(sp)
move s0, a1
lw a1, (a1)
sw gp, 0x20(sp)
sw ra, 0x34(sp)
sw s1, 0x2c(sp)
jalr t9
addiu a0, a0, str._s:_s:_s
lw gp, 0x20(sp)
move a1, v0
move a0, s2
lw t9, -sym.imp.g_hash_table_lookup(gp)
jalr t9
move s1, v0
beqz v0, 0x423c
--
lw v1, (a0)
addiu v0, zero, 2
sw gp, 0x30(sp)
sw s4, 0x4c(sp)
sw s3, 0x48(sp)
sw s2, 0x44(sp)
sw s1, 0x40(sp)
sw s0, 0x3c(sp)
lw s3, 4(a0)
move s0, a0
lw s4, 8(a0)
lw s1, 0xc(a0)
lw s2, 0x10(a0)
sw ra, 0x54(sp)
sw s5, 0x50(sp)
lw a0, 0x14(a0)
beq v1, v0, 0x44f8
lw t9, -sym.utils_get_type(gp)
bal sym.utils_get_type
lw s5, 0x1c(s0)
lw v1, 0x18(s0)
lw a0, 0x20(s0)
lw gp, 0x30(sp)
lw v1, (v1)
sw a0, 0x28(sp)
lw t9, -sym.imp.g_strdup_printf(gp)
lw a0, 8(v1)
move a3, s4
sw a0, 0x24(sp)
lw a0, 4(v1)
move a2, s5
sw a0, 0x20(sp)
lw v1, (v1)
lw a0, -0x7fc0(gp)
move a1, s3
sw v1, 0x1c(sp)
sw s2, 0x14(sp)
sw s1, 0x10(sp)
sw v0, 0x18(sp)
jalr t9
addiu a0, a0, str.group:__s__dyn_index:__d__param:__s__file:__s__parser:__d__type:__d__dbus_name:__s__object:__s__interface:__s__parameter_name:__s
lw ra, 0x54(sp)
lw s5, 0x50(sp)
lw s4, 0x4c(sp)
lw s3, 0x48(sp)
lw s2, 0x44(sp)
lw s1, 0x40(sp)
lw s0, 0x3c(sp)
jr ra
addiu sp, sp, 0x58
bal sym.utils_get_type
nop
lw v1, 0x18(s0)
lw a0, 0x1c(s0)
lw gp, 0x30(sp)
lw v1, (v1)
sw a0, 0x24(sp)
lw t9, -sym.imp.g_strdup_printf(gp)
lw a0, 8(v1)
move a3, s1
sw a0, 0x20(sp)
lw a0, 4(v1)
move a2, s4
sw a0, 0x1c(sp)
lw v1, (v1)
lw a0, -0x7fc0(gp)
move a1, s3
sw v1, 0x18(sp)
sw s2, 0x10(sp)
sw v0, 0x14(sp)
jalr t9
addiu a0, a0, str.group:__s__param:__s__file:__s__parser:__d__type:__d__dbus_name:__s__object:__s__interface:__s__property_name:__s
lw ra, 0x54(sp)
lw s5, 0x50(sp)
lw s4, 0x4c(sp)
lw s3, 0x48(sp)
lw s2, 0x44(sp)
lw s1, 0x40(sp)
--
lw a0, -0x7fc8(gp)
lw t9, -sym.param2dbusprop_create_property_list(gp)
addiu a1, zero, 1
b sym.param2dbusprop_create_property_list
addiu a0, a0, 0x7840
lui gp, 2
addiu gp, gp, -0x56e0
addu gp, gp, t9
addiu sp, sp, -0x20
lw t9, -sym.imp.strchr(gp)
sw gp, 0x10(sp)
sw ra, 0x1c(sp)
jalr t9
addiu a1, zero, 0xa
bnel v0, zero, 0x4f8c
addiu v0, v0, 1
lw ra, 0x1c(sp)
jr ra
addiu sp, sp, 0x20
nop
nop
lui gp, 2
addiu gp, gp, -0x5720
addu gp, gp, t9
addiu sp, sp, -0x50
lw t9, -sym.imp.g_strdup_printf(gp)
sw s2, 0x30(sp)
lw s2, -0x7e4c(gp)
sw s7, 0x44(sp)
move s7, a0
lw v0, (s2)
lw a0, -0x7fc0(gp)
sw gp, 0x10(sp)
sw ra, 0x4c(sp)
sw s6, 0x40(sp)
sw s5, 0x3c(sp)
sw s4, 0x38(sp)
sw s3, 0x34(sp)
sw s1, 0x2c(sp)
sw s0, 0x28(sp)
sw fp, 0x48(sp)
addiu a0, a0, str.s__s_________
sw zero, (a1)
sw v0, 0x24(sp)
sw zero, (a2)
sw zero, 0x1c(sp)
--
addiu sp, sp, 0x50
lw t9, -sym.imp.g_regex_match(gp)
addiu fp, sp, 0x1c
move a3, fp
move a2, zero
move a1, s7
jalr t9
move a0, v0
bnez v0, 0x5190
lw gp, 0x10(sp)
lw t9, -0x7e20(gp)
jalr t9
move a0, s1
lw gp, 0x10(sp)
lw t9, -sym.imp.g_regex_unref(gp)
jalr t9
move a0, s0
lw a0, 0x1c(sp)
beqz a0, 0x5138
lw gp, 0x10(sp)
lw t9, -sym.imp.g_match_info_free(gp)
jalr t9
nop
lw gp, 0x10(sp)
lw a0, -0x7fc0(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
jalr t9
addiu a0, a0, str.s__s___S_
lw gp, 0x10(sp)
move a3, s6
move a2, zero
lw t9, -sym.imp.g_regex_new(gp)
move a1, zero
move a0, v0
jalr t9
move s3, v0
lw gp, 0x10(sp)
move a3, fp
move a2, zero
lw t9, -sym.imp.g_regex_match(gp)
move a1, s7
move a0, v0
jalr t9
move s0, v0
beqz v0, 0x504c
lw gp, 0x10(sp)
--
move s0, s1
move v0, s0
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x30
lw ra, 0x2c(sp)
lw s2, 0x24(sp)
lw s0, 0x1c(sp)
move a1, s3
move a0, s1
lw s3, 0x28(sp)
lw s1, 0x20(sp)
lw t9, -sym.imp.g_strndup(gp)
jr t9
addiu sp, sp, 0x30
nop
nop
nop
lui gp, 2
addiu gp, gp, -0x5db0
addu gp, gp, t9
addiu sp, sp, -0x50
lw t9, -sym.imp.g_strdup_printf(gp)
sw s2, 0x30(sp)
lw s2, -0x7e4c(gp)
sw s7, 0x44(sp)
move s7, a0
lw v0, (s2)
lw a0, -0x7fc0(gp)
sw gp, 0x10(sp)
sw ra, 0x4c(sp)
sw s6, 0x40(sp)
sw s5, 0x3c(sp)
sw s4, 0x38(sp)
sw s3, 0x34(sp)
sw s1, 0x2c(sp)
sw s0, 0x28(sp)
sw fp, 0x48(sp)
addiu a0, a0, str.__t____s____t____t_________
sw zero, (a1)
sw v0, 0x24(sp)
sw zero, (a2)
sw zero, 0x1c(sp)
--
addiu sp, sp, 0x50
lw t9, -sym.imp.g_regex_match(gp)
addiu fp, sp, 0x1c
move a3, fp
move a2, zero
move a1, s7
jalr t9
move a0, v0
bnez v0, 0x5820
lw gp, 0x10(sp)
lw t9, -0x7e20(gp)
jalr t9
move a0, s1
lw gp, 0x10(sp)
lw t9, -sym.imp.g_regex_unref(gp)
jalr t9
move a0, s0
lw a0, 0x1c(sp)
beqz a0, 0x57c8
lw gp, 0x10(sp)
lw t9, -sym.imp.g_match_info_free(gp)
jalr t9
nop
lw gp, 0x10(sp)
lw a0, -0x7fc0(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
jalr t9
addiu a0, a0, str.__t____s____t____t___S_
lw gp, 0x10(sp)
move a3, s6
move a2, zero
lw t9, -sym.imp.g_regex_new(gp)
move a1, zero
move a0, v0
jalr t9
move s3, v0
lw gp, 0x10(sp)
move a3, fp
move a2, zero
lw t9, -sym.imp.g_regex_match(gp)
move a1, s7
move a0, v0
jalr t9
move s0, v0
beqz v0, 0x56dc
lw gp, 0x10(sp)

[*] Function printf used 9 times param_upgrader