[*] Binary protection state of image.cgi
Full RELRO Canary found NX disabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function printf tear down of image.cgi
; assembly | /* r2dec pseudo code output */
| /* /logs/firmware/unblob_extracted/firmware_extract/4325012-58052244.squashfs_v4_le_extract/usr/html/axis-cgi/jpg2/image.cgi @ 0x15ac */
| #include <stdint.h>
|
; (fcn) fcn.000015ac () | void fcn_000015ac () {
0x000015ac lui gp, 2 |
0x000015b0 addiu gp, gp, -0x659c |
0x000015b4 addu gp, gp, t9 | gp += t9;
0x000015b8 addiu sp, sp, -0x88 |
0x000015bc lw t9, -0x7f98(gp) | t9 = sym.imp.g_hash_table_lookup;
0x000015c0 sw s3, 0x70(sp) | *(var_70h) = s3;
0x000015c4 lw s3, -0x7f90(gp) | s3 = *((gp - 8164));
0x000015c8 sw s5, 0x78(sp) | *(var_78h) = s5;
0x000015cc move s5, a1 | s5 = a1;
0x000015d0 lw v0, (s3) | v0 = *(s3);
0x000015d4 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x000015d8 sw gp, 0x10(sp) | *(var_10h) = gp;
0x000015dc sw s7, 0x80(sp) | *(var_80h) = s7;
0x000015e0 sw s6, 0x7c(sp) | *(var_7ch) = s6;
0x000015e4 sw ra, 0x84(sp) | *(var_84h) = ra;
0x000015e8 sw s4, 0x74(sp) | *(var_74h) = s4;
0x000015ec sw s2, 0x6c(sp) | *(var_6ch) = s2;
0x000015f0 sw s1, 0x68(sp) | *(var_68h) = s1;
0x000015f4 sw s0, 0x64(sp) | *(var_64h) = s0;
0x000015f8 addiu a1, a1, 0x22b8 | a1 += str.camera;
0x000015fc sw v0, 0x5c(sp) | *(var_5ch) = v0;
0x00001600 sw zero, 0x20(sp) | *(var_20h) = 0;
0x00001604 move s7, a0 | s7 = a0;
0x00001608 move s6, a2 | s6 = a2;
0x0000160c jalr t9 | t9 ();
0x00001610 lw gp, 0x10(sp) | gp = *(var_10h);
| if (v0 == 0) {
0x00001614 beqz v0, 0x1850 | goto label_4;
| }
0x00001618 lw t9, -0x7f7c(gp) | t9 = sym.imp.g_ascii_strtoull;
0x0000161c move a2, zero | a2 = 0;
0x00001620 move a1, zero | a1 = 0;
0x00001624 move a0, v0 | a0 = v0;
0x00001628 move s0, v0 | s0 = v0;
0x0000162c jalr t9 | t9 ();
0x00001630 move s2, v0 | s2 = v0;
0x00001634 lw gp, 0x10(sp) | gp = *(var_10h);
| if (v0 == 0) {
0x00001638 beqz v0, 0x18cc | goto label_5;
| }
| label_0:
0x0000163c lw t9, -0x7fa0(gp) | t9 = sym.imp.vdo_channel_get;
0x00001640 addiu s1, sp, 0x20 | s1 = sp + 0x20;
0x00001644 move a1, s1 | a1 = s1;
0x00001648 move a0, s2 | a0 = s2;
0x0000164c jalr t9 | t9 ();
0x00001650 move s0, v0 | s0 = v0;
0x00001654 lw gp, 0x10(sp) | gp = *(var_10h);
| if (v0 == 0) {
0x00001658 beqz v0, 0x1814 | goto label_6;
| }
0x0000165c lw t9, -0x7f74(gp) | t9 = sym.imp.vdo_channel_get_settings;
0x00001660 move a1, s1 | a1 = s1;
0x00001664 move a0, v0 | a0 = v0;
0x00001668 jalr t9 | t9 ();
0x0000166c lw gp, 0x10(sp) | gp = *(var_10h);
0x00001670 move s4, v0 | s4 = v0;
0x00001674 lw t9, -0x7f08(gp) | t9 = sym.imp.g_object_unref;
0x00001678 move a0, s0 | a0 = s0;
0x0000167c jalr t9 | t9 ();
0x00001680 lw gp, 0x10(sp) | gp = *(var_10h);
| if (s4 == 0) {
0x00001684 beqz s4, 0x1814 | goto label_6;
| }
0x00001688 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x0000168c lw t9, -0x7f78(gp) | t9 = sym.imp.vdo_map_get_boolean;
0x00001690 move a0, s4 | a0 = s4;
0x00001694 addiu a2, zero, 1 | a2 = 1;
0x00001698 addiu a1, a1, 0x2308 | a1 += str.enabled;
0x0000169c jalr t9 | t9 ();
0x000016a0 lw gp, 0x10(sp) | gp = *(var_10h);
0x000016a4 move a0, s4 | a0 = s4;
0x000016a8 lw t9, -0x7f08(gp) | t9 = sym.imp.g_object_unref;
| if (v0 == 0) {
0x000016ac beqz v0, 0x1808 | goto label_7;
| }
0x000016b0 jalr t9 | t9 ();
0x000016b4 nop |
0x000016b8 lw gp, 0x10(sp) | gp = *(var_10h);
0x000016bc lw t9, -0x7f48(gp) | t9 = sym.imp.vdo_map_new;
0x000016c0 jalr t9 | t9 ();
0x000016c4 nop |
0x000016c8 lw gp, 0x10(sp) | gp = *(var_10h);
0x000016cc move a0, v0 | a0 = v0;
0x000016d0 move a2, s2 | a2 = s2;
0x000016d4 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x000016d8 lw t9, -0x7f58(gp) | t9 = sym.imp.vdo_map_set_uint32;
0x000016dc addiu a1, a1, 0x2310 | a1 += str.channel;
0x000016e0 move s0, v0 | s0 = v0;
0x000016e4 jalr t9 | t9 ();
0x000016e8 lw gp, 0x10(sp) | gp = *(var_10h);
0x000016ec addiu a2, zero, 4 | a2 = 4;
0x000016f0 move a0, s0 | a0 = s0;
0x000016f4 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x000016f8 lw t9, -0x7f58(gp) | t9 = sym.imp.vdo_map_set_uint32;
0x000016fc addiu a1, a1, 0x2318 | a1 += str.buffer.strategy;
0x00001700 jalr t9 | t9 ();
0x00001704 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001708 addiu a2, zero, 2 | a2 = 2;
0x0000170c move a0, s0 | a0 = s0;
0x00001710 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00001714 lw t9, -0x7f58(gp) | t9 = sym.imp.vdo_map_set_uint32;
0x00001718 addiu a1, a1, 0x2328 | a1 += str.format;
0x0000171c jalr t9 | t9 ();
0x00001720 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001724 addiu a3, sp, 0x24 | a3 = sp + 0x24;
0x00001728 move a2, zero | a2 = 0;
0x0000172c lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00001730 lw t9, -0x7f0c(gp) | t9 = sym.imp.g_hash_table_lookup_extended;
0x00001734 addiu a1, a1, 0x2330 | a1 += str.resolution;
0x00001738 move a0, s7 | a0 = s7;
0x0000173c jalr t9 | t9 ();
0x00001740 lw gp, 0x10(sp) | gp = *(var_10h);
| if (v0 == 0) {
0x00001744 beqz v0, 0x17cc | goto label_1;
| }
0x00001748 lw a0, 0x24(sp) | a0 = *(var_24h_2);
0x0000174c lw t9, -0x7fd8(gp) | t9 = *(gp);
| if (a0 == 0) {
0x00001750 beqz a0, 0x19a0 | goto label_8;
| }
0x00001754 move a3, s1 | a3 = s1;
0x00001758 addiu a2, sp, 0x18 | a2 = sp + 0x18;
0x0000175c addiu a1, sp, 0x1c | a1 = sp + 0x1c;
0x00001760 bal 0x1c70 | fcn_00001c70 ();
0x00001764 lw gp, 0x10(sp) | gp = *(var_10h);
| if (v0 == 0) {
0x00001768 beqz v0, 0x1858 | goto label_9;
| }
0x0000176c lw t9, -0x7f24(gp) | t9 = sym.imp.check_resolution_type_flags;
0x00001770 lw a0, 0x24(sp) | a0 = *(var_24h_2);
0x00001774 move a3, zero | a3 = 0;
0x00001778 move a2, zero | a2 = 0;
0x0000177c move a1, zero | a1 = 0;
0x00001780 jalr t9 | t9 ();
0x00001784 lw gp, 0x10(sp) | gp = *(var_10h);
| if (v0 == 0) {
0x00001788 beqz v0, 0x1930 | goto label_10;
| }
0x0000178c lw v0, (v0) | v0 = *(v0);
0x00001790 lw t9, -0x7f58(gp) | t9 = sym.imp.vdo_map_set_uint32;
| if (v0 == 0) {
0x00001794 beqz v0, 0x1930 | goto label_10;
| }
0x00001798 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x0000179c lw a2, 0x1c(sp) | a2 = *(var_1ch_2);
0x000017a0 addiu a1, a1, 0x2388 | a1 += str.width;
0x000017a4 move a0, s0 | a0 = s0;
0x000017a8 jalr t9 | t9 ();
0x000017ac lw gp, 0x10(sp) | gp = *(var_10h);
0x000017b0 lw a2, 0x18(sp) | a2 = *(var_18h_2);
0x000017b4 move a0, s0 | a0 = s0;
0x000017b8 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x000017bc lw t9, -0x7f58(gp) | t9 = sym.imp.vdo_map_set_uint32;
0x000017c0 addiu a1, a1, 0x2390 | a1 += str.height;
0x000017c4 jalr t9 | t9 ();
0x000017c8 lw gp, 0x10(sp) | gp = *(var_10h);
| do {
| label_1:
0x000017cc lw a0, 0x5c(sp) | a0 = *(var_5ch);
0x000017d0 lw v1, (s3) | v1 = *(s3);
0x000017d4 move v0, s0 | v0 = s0;
| if (a0 != v1) {
0x000017d8 bne a0, v1, 0x19d0 | goto label_11;
| }
0x000017dc lw ra, 0x84(sp) | ra = *(var_84h);
0x000017e0 lw s7, 0x80(sp) | s7 = *(var_80h);
0x000017e4 lw s6, 0x7c(sp) | s6 = *(var_7ch);
0x000017e8 lw s5, 0x78(sp) | s5 = *(var_78h);
0x000017ec lw s4, 0x74(sp) | s4 = *(var_74h);
0x000017f0 lw s3, 0x70(sp) | s3 = *(var_70h);
0x000017f4 lw s2, 0x6c(sp) | s2 = *(var_6ch);
0x000017f8 lw s1, 0x68(sp) | s1 = *(var_68h);
0x000017fc lw s0, 0x64(sp) | s0 = *(var_64h);
0x00001800 addiu sp, sp, 0x88 |
0x00001804 jr ra | return v0;
| label_7:
0x00001808 jalr t9 | t9 ();
0x0000180c nop |
0x00001810 lw gp, 0x10(sp) | gp = *(var_10h);
| label_6:
0x00001814 lw t9, -0x7f1c(gp) | t9 = sym.imp.g_clear_error;
0x00001818 move a0, s1 | a0 = s1;
0x0000181c jalr t9 | t9 ();
0x00001820 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001824 move s0, zero | s0 = 0;
0x00001828 lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x0000182c lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00001830 lw t9, -0x7f18(gp) | t9 = sym.imp.g_strdup;
0x00001834 addiu v0, v0, 0x22c0 | v0 += str.400_Bad_Request;
0x00001838 sw v0, (s5) | *(s5) = v0;
0x0000183c addiu a0, a0, 0x23d0 | a0 += str.The_request_had_bad_syntax_or_was_inherently_impossible_to_be_satisfied._n;
0x00001840 jalr t9 | t9 ();
0x00001844 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001848 sw v0, (s6) | *(s6) = v0;
0x0000184c b 0x17cc |
| } while (1);
| label_4:
0x00001850 addiu s2, zero, 1 | s2 = 1;
0x00001854 b 0x163c | goto label_0;
| label_9:
0x00001858 lw v0, 0x20(sp) | v0 = *(var_20h);
0x0000185c lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
| if (v0 == 0) {
0x00001860 beqz v0, 0x19c8 | goto label_12;
| }
0x00001864 lw a1, 8(v0) | a1 = *((v0 + 2));
| label_3:
0x00001868 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x0000186c lw t9, -0x7f3c(gp) | t9 = sym.imp.g_printerr;
0x00001870 addiu a0, a0, 0x2358 | a0 += str.parse_failed:__s__n;
0x00001874 jalr t9 | t9 ();
0x00001878 lw v0, 0x20(sp) | v0 = *(var_20h);
0x0000187c lw gp, 0x10(sp) | gp = *(var_10h);
| if (v0 == 0) {
0x00001880 beqz v0, 0x1990 | goto label_13;
| }
0x00001884 lw v1, -0x7fdc(gp) | v1 = *((gp - 8183));
0x00001888 lw t9, -0x7f18(gp) | t9 = sym.imp.g_strdup;
0x0000188c addiu v1, v1, 0x22c0 | v1 += str.400_Bad_Request;
0x00001890 sw v1, (s5) | *(s5) = v1;
0x00001894 lw a0, 8(v0) | a0 = *((v0 + 2));
0x00001898 jalr t9 | t9 ();
0x0000189c lw gp, 0x10(sp) | gp = *(var_10h);
0x000018a0 lw a0, 0x20(sp) | a0 = *(var_20h);
0x000018a4 lw t9, -0x7f9c(gp) | t9 = sym.imp.g_error_free;
0x000018a8 sw v0, (s6) | *(s6) = v0;
0x000018ac jalr t9 | t9 ();
0x000018b0 lw gp, 0x10(sp) | gp = *(var_10h);
| do {
| label_2:
0x000018b4 lw t9, -0x7f08(gp) | t9 = sym.imp.g_object_unref;
0x000018b8 move a0, s0 | a0 = s0;
0x000018bc jalr t9 | t9 ();
0x000018c0 move s0, zero | s0 = 0;
0x000018c4 lw gp, 0x10(sp) | gp = *(var_10h);
0x000018c8 b 0x17cc | goto label_1;
| label_5:
0x000018cc lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x000018d0 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x000018d4 lw t9, -0x7f3c(gp) | t9 = sym.imp.g_printerr;
0x000018d8 addiu v0, v0, 0x22c0 | v0 += str.400_Bad_Request;
0x000018dc move a1, s0 | a1 = s0;
0x000018e0 addiu a0, a0, 0x22d0 | a0 += str.invalid_camera_number:__s;
0x000018e4 sw v0, (s5) | *(s5) = v0;
0x000018e8 jalr t9 | t9 ();
0x000018ec lw gp, 0x10(sp) | gp = *(var_10h);
0x000018f0 move a3, s0 | a3 = s0;
0x000018f4 addiu s0, sp, 0x28 | s0 = sp + 0x28;
0x000018f8 lw a2, -0x7fdc(gp) | a2 = *((gp - 8183));
0x000018fc lw t9, -0x7f70(gp) | t9 = sym.imp.g_snprintf
0x00001900 move a0, s0 | a0 = s0;
0x00001904 addiu a2, a2, 0x22ec | a2 += str.Invalid_camera_number__s;
0x00001908 addiu a1, zero, 0x32 | a1 = 0x32;
0x0000190c jalr t9 | t9 ();
0x00001910 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001914 move a0, s0 | a0 = s0;
0x00001918 lw t9, -0x7f18(gp) | t9 = sym.imp.g_strdup;
0x0000191c move s0, zero | s0 = 0;
0x00001920 jalr t9 | t9 ();
0x00001924 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001928 sw v0, (s6) | *(s6) = v0;
0x0000192c b 0x17cc | goto label_1;
| label_10:
0x00001930 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00001934 lw t9, -0x7f3c(gp) | t9 = sym.imp.g_printerr;
0x00001938 lw a1, 0x24(sp) | a1 = *(var_24h_2);
0x0000193c addiu a0, a0, 0x2398 | a0 += str.not_a_valid_resolution__s;
0x00001940 jalr t9 | t9 ();
0x00001944 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001948 lw a3, 0x24(sp) | a3 = *(var_24h_2);
0x0000194c addiu s1, sp, 0x28 | s1 = sp + 0x28;
0x00001950 lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x00001954 lw a2, -0x7fdc(gp) | a2 = *((gp - 8183));
0x00001958 lw t9, -0x7f70(gp) | t9 = sym.imp.g_snprintf
0x0000195c addiu v0, v0, 0x22c0 | v0 += str.400_Bad_Request;
0x00001960 addiu a2, a2, 0x23b4 | a2 += str.Not_a_valid_resolution__s;
0x00001964 addiu a1, zero, 0x32 | a1 = 0x32;
0x00001968 move a0, s1 | a0 = s1;
0x0000196c sw v0, (s5) | *(s5) = v0;
0x00001970 jalr t9 | t9 ();
0x00001974 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001978 lw t9, -0x7f18(gp) | t9 = sym.imp.g_strdup;
0x0000197c move a0, s1 | a0 = s1;
0x00001980 jalr t9 | t9 ();
0x00001984 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001988 sw v0, (s6) | *(s6) = v0;
0x0000198c b 0x18b4 |
| } while (1);
| label_13:
0x00001990 lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x00001994 addiu v0, v0, 0x236c | v0 += str.500_Internal_Server_Error;
0x00001998 sw v0, (s5) | *(s5) = v0;
0x0000199c b 0x18b4 | goto label_2;
| label_8:
0x000019a0 lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x000019a4 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x000019a8 lw t9, -0x7f18(gp) | t9 = sym.imp.g_strdup;
0x000019ac addiu v0, v0, 0x22c0 | v0 += str.400_Bad_Request;
0x000019b0 sw v0, (s5) | *(s5) = v0;
0x000019b4 addiu a0, a0, 0x233c | a0 += str.Missing_resolution_value;
0x000019b8 jalr t9 | t9 ();
0x000019bc lw gp, 0x10(sp) | gp = *(var_10h);
0x000019c0 sw v0, (s6) | *(s6) = v0;
0x000019c4 b 0x18b4 | goto label_2;
| label_12:
0x000019c8 addiu a1, a1, 0x24c8 | a1 += 0x24c8;
0x000019cc b 0x1868 | goto label_3;
| label_11:
0x000019d0 lw t9, -0x7f94(gp) | t9 = sym.imp.__stack_chk_fail;
0x000019d4 jalr t9 | t9 ();
0x000019d8 nop |
0x000019dc nop |
| }
[*] Function printf used 3 times image.cgi
