[*] Binary protection state of snmpd

  
  	Full RELRO     Canary found      NX disabled  PIE enabled  No RPATH     No RUNPATH   No Symbols


[*] Function strcpy tear down of snmpd

    ; assembly                               | /* r2dec pseudo code output */
                                             | /* /logs/firmware/unblob_extracted/firmware_extract/4325012-58052244.squashfs_v4_le_extract/usr/sbin/snmpd @ 0x1af38 */
                                             | #include <stdint.h>
                                             |  
    ; (fcn) sym.arp_list_addresses ()        | void arp_list_addresses () {
    0x0001af38 lui gp, 3                     |     
    0x0001af3c addiu gp, gp, 0x6658          |     
    0x0001af40 addu gp, gp, t9               |     gp += t9;
    0x0001af44 lw v0, -0x77a4(gp)            |     v0 = *((gp - 7657));
    0x0001af48 addiu sp, sp, -0x220          |     
    0x0001af4c lw t9, -0x7774(gp)            |     t9 = sym.imp.socket;
    0x0001af50 sw v0, 0x70(sp)               |     *(var_70h) = v0;
    0x0001af54 lw v0, (v0)                   |     v0 = *(v0);
    0x0001af58 sw gp, 0x38(sp)               |     *(var_38h) = gp;
    0x0001af5c sw a0, 0x74(sp)               |     *(var_74h) = a0;
    0x0001af60 sw ra, 0x21c(sp)              |     *(var_21ch) = ra;
    0x0001af64 sw fp, 0x218(sp)              |     *(var_218h) = fp;
    0x0001af68 sw s7, 0x214(sp)              |     *(var_214h) = s7;
    0x0001af6c sw s6, 0x210(sp)              |     *(var_210h) = s6;
    0x0001af70 sw s5, 0x20c(sp)              |     *(var_20ch) = s5;
    0x0001af74 sw s4, 0x208(sp)              |     *(var_208h) = s4;
    0x0001af78 sw s3, 0x204(sp)              |     *(var_204h) = s3;
    0x0001af7c sw s2, 0x200(sp)              |     *(var_200h) = s2;
    0x0001af80 sw s1, 0x1fc(sp)              |     *(var_1fch) = s1;
    0x0001af84 sw s0, 0x1f8(sp)              |     *(var_1f8h) = s0;
    0x0001af88 move a2, zero                 |     a2 = 0;
    0x0001af8c addiu a1, zero, 1             |     a1 = 1;
    0x0001af90 addiu a0, zero, 2             |     a0 = 2;
    0x0001af94 sw v0, 0x1f4(sp)              |     *(var_1f4h) = v0;
    0x0001af98 jalr t9                       |     t9 ();
    0x0001af9c nop                           |     
    0x0001afa0 sw v0, 0x6c(sp)               |     *(var_6ch) = v0;
    0x0001afa4 lw gp, 0x38(sp)               |     gp = *(var_38h);
                                             |     if (v0 < 0) {
    0x0001afa8 bltz v0, 0x1b318              |         goto label_5;
                                             |     }
    0x0001afac lw a1, -0x7fdc(gp)            |     a1 = *(gp);
    0x0001afb0 lw a0, -0x7fdc(gp)            |     a0 = *(gp);
    0x0001afb4 lw t9, -0x77a0(gp)            |     t9 = sym.imp.fopen;
    0x0001afb8 addiu a1, a1, 0x73dc          |     a1 += 0x73dc;
                                             |     /* str._proc_net_arp */
    0x0001afbc addiu a0, a0, 0x43a8          |     a0 += 0x43a8;
    0x0001afc0 jalr t9                       |     t9 ();
    0x0001afc4 move s1, v0                   |     s1 = v0;
    0x0001afc8 lw gp, 0x38(sp)               |     gp = *(var_38h);
                                             |     if (v0 == 0) {
    0x0001afcc beqz v0, 0x1b318              |         goto label_5;
                                             |     }
    0x0001afd0 lw s2, -0x7fdc(gp)            |     s2 = *(gp);
    0x0001afd4 move s0, zero                 |     s0 = 0;
    0x0001afd8 sw zero, 0x40(sp)             |     *(var_40h_2) = 0;
    0x0001afdc addiu s6, sp, 0xf4            |     s6 = sp + 0xf4;
    0x0001afe0 addiu s5, sp, 0x7c            |     s5 = sp + 0x7c;
    0x0001afe4 addiu s4, sp, 0x78            |     s4 = sp + 0x78;
    0x0001afe8 addiu fp, sp, 0xdc            |     fp = sp + 0xdc;
                                             |     /* str._d._d._d._d_0x_x_0x_x__x:_x:_x:_x:_x:_x_______20s_n */
    0x0001afec addiu s2, s2, 0x43b8          |     s2 += 0x43b8;
                                             |     do {
    0x0001aff0 lw t9, -0x7810(gp)            |         t9 = sym.imp.fgets;
                                             | label_0:
    0x0001aff4 move a2, s1                   |         a2 = s1;
    0x0001aff8 addiu a1, zero, 0x100         |         a1 = aav.0x00000100;
    0x0001affc move a0, s6                   |         a0 = s6;
    0x0001b000 jalr t9                       |         t9 ();
    0x0001b004 lw gp, 0x38(sp)               |         gp = *(var_38h);
                                             |         if (s6 != v0) {
    0x0001b008 bne s6, v0, 0x1b1d4           |             goto label_6;
                                             |         }
                                             | label_1:
    0x0001b00c addiu v0, sp, 0x9c            |         v0 = sp + 0x9c;
    0x0001b010 sw v0, 0x30(sp)               |         *(var_30h_2) = v0;
    0x0001b014 addiu v0, sp, 0x98            |         v0 = sp + 0x98;
    0x0001b018 sw v0, 0x2c(sp)               |         *(var_2ch_2) = v0;
    0x0001b01c addiu v0, sp, 0x94            |         v0 = sp + 0x94;
    0x0001b020 sw v0, 0x28(sp)               |         *(var_28h_2) = v0;
    0x0001b024 addiu v0, sp, 0x90            |         v0 = sp + 0x90;
    0x0001b028 sw v0, 0x24(sp)               |         *(var_24h_2) = v0;
    0x0001b02c addiu v0, sp, 0x8c            |         v0 = sp + 0x8c;
    0x0001b030 sw v0, 0x20(sp)               |         *(var_20h_2) = v0;
    0x0001b034 addiu v0, sp, 0x88            |         v0 = sp + 0x88;
    0x0001b038 sw v0, 0x1c(sp)               |         *(var_1ch) = v0;
    0x0001b03c addiu v0, sp, 0xa0            |         v0 = sp + 0xa0;
    0x0001b040 sw v0, 0x18(sp)               |         *(var_18h_3) = v0;
    0x0001b044 addiu v0, sp, 0x84            |         v0 = sp + 0x84;
    0x0001b048 lw t9, -0x78e0(gp)            |         t9 = sym.imp.__isoc99_sscanf;
    0x0001b04c sw v0, 0x14(sp)               |         *(var_14h_2) = v0;
    0x0001b050 addiu v0, sp, 0x80            |         v0 = sp + 0x80;
    0x0001b054 move a0, s6                   |         a0 = s6;
    0x0001b058 sw fp, 0x34(sp)               |         *(var_34h) = fp;
    0x0001b05c sw v0, 0x10(sp)               |         *(var_10h_2) = v0;
    0x0001b060 move a3, s5                   |         a3 = s5;
    0x0001b064 move a2, s4                   |         a2 = s4;
    0x0001b068 move a1, s2                   |         a1 = s2;
    0x0001b06c sb zero, 0xf0(sp)             |         *(var_f0h) = 0;
    0x0001b070 jalr t9                       |         t9 ();
    0x0001b074 addiu a0, zero, 0xc           |         a0 = 0xc;
    0x0001b078 lw gp, 0x38(sp)               |         gp = *(var_38h);
    0x0001b07c bne v0, a0, 0x1aff0           |         
                                             |     } while (v0 != a0);
    0x0001b080 lw s3, 0xa0(sp)               |     s3 = *(var_a0h);
    0x0001b084 lw t9, -0x7810(gp)            |     t9 = sym.imp.fgets;
                                             |     if (s3 == 0) {
    0x0001b088 beqz s3, 0x1aff4              |         goto label_0;
                                             |     }
    0x0001b08c lbu v0, 0x78(sp)              |     v0 = *(var_78h);
    0x0001b090 lw t9, -0x789c(gp)            |     t9 = sym.imp.__strcpy_chk
    0x0001b094 sw v0, 0x44(sp)               |     *(var_44h_2) = v0;
    0x0001b098 lbu v0, 0x7c(sp)              |     v0 = *(var_7ch);
    0x0001b09c addiu t3, sp, 0xbc            |     t3 = sp + 0xbc;
    0x0001b0a0 sw v0, 0x48(sp)               |     *(var_48h_2) = v0;
    0x0001b0a4 lbu v0, 0x80(sp)              |     v0 = *(var_80h);
    0x0001b0a8 move a0, t3                   |     a0 = t3;
    0x0001b0ac sw v0, 0x4c(sp)               |     *(var_4ch_2) = v0;
    0x0001b0b0 lbu v0, 0x84(sp)              |     v0 = *(var_84h);
    0x0001b0b4 addiu a2, zero, 0x10          |     a2 = 0x10;
    0x0001b0b8 sw v0, 0x50(sp)               |     *(var_50h) = v0;
    0x0001b0bc lbu v0, 0x88(sp)              |     v0 = *(var_88h);
    0x0001b0c0 move a1, fp                   |     a1 = fp;
    0x0001b0c4 sw v0, 0x54(sp)               |     *(var_54h) = v0;
    0x0001b0c8 lbu v0, 0x8c(sp)              |     v0 = *(var_8ch);
    0x0001b0cc sw v0, 0x58(sp)               |     *(var_58h) = v0;
    0x0001b0d0 lbu v0, 0x90(sp)              |     v0 = *(var_90h);
    0x0001b0d4 sw v0, 0x5c(sp)               |     *(var_5ch) = v0;
    0x0001b0d8 lbu v0, 0x94(sp)              |     v0 = *(var_94h);
    0x0001b0dc sw v0, 0x60(sp)               |     *(var_60h) = v0;
    0x0001b0e0 lbu v0, 0x98(sp)              |     v0 = *(var_98h);
    0x0001b0e4 sw v0, 0x64(sp)               |     *(var_64h) = v0;
    0x0001b0e8 lbu v0, 0x9c(sp)              |     v0 = *(var_9ch);
    0x0001b0ec sw v0, 0x68(sp)               |     *(var_68h) = v0;
    0x0001b0f0 jalr t9                       |     t9 ();
    0x0001b0f4 lw gp, 0x38(sp)               |     gp = *(var_38h);
    0x0001b0f8 lw a0, 0x6c(sp)               |     a0 = *(var_6ch);
    0x0001b0fc move a2, v0                   |     a2 = v0;
    0x0001b100 lw t9, -0x7a70(gp)            |     t9 = sym.imp.ioctl;
    0x0001b104 ori a1, zero, 0x8933          |     a1 = 0x8933;
    0x0001b108 jalr t9                       |     t9 ();
    0x0001b10c lw gp, 0x38(sp)               |     gp = *(var_38h);
                                             |     if (v0 < 0) {
    0x0001b110 bltz v0, 0x1b24c              |         goto label_7;
                                             |     }
    0x0001b114 lw s7, 0xcc(sp)               |     s7 = *(var_cch);
                                             | label_2:
    0x0001b118 lw t9, -0x781c(gp)            |     t9 = sym.imp.malloc;
    0x0001b11c addiu a0, zero, 0x18          |     a0 = 0x18;
    0x0001b120 jalr t9                       |     t9 ();
    0x0001b124 lw gp, 0x38(sp)               |     gp = *(var_38h);
                                             |     if (v0 == 0) {
    0x0001b128 beqz v0, 0x1b1d4              |         goto label_6;
                                             |     }
    0x0001b12c lw v1, 0x44(sp)               |     v1 = *(var_44h_2);
    0x0001b130 lw t9, -0x7810(gp)            |     t9 = sym.imp.fgets;
    0x0001b134 sb v1, 0xa8(sp)               |     *(var_a8h) = v1;
    0x0001b138 lw v1, 0x48(sp)               |     v1 = *(var_48h_2);
    0x0001b13c move a2, s1                   |     a2 = s1;
    0x0001b140 sb v1, 0xa9(sp)               |     *(var_a9h) = v1;
    0x0001b144 lw v1, 0x4c(sp)               |     v1 = *(var_4ch_2);
    0x0001b148 addiu a1, zero, 0x100         |     a1 = aav.0x00000100;
    0x0001b14c sb v1, 0xaa(sp)               |     *(var_aah) = v1;
    0x0001b150 lw v1, 0x50(sp)               |     v1 = *(var_50h);
    0x0001b154 sw s0, (v0)                   |     *(v0) = s0;
    0x0001b158 sb v1, 0xab(sp)               |     *(var_abh) = v1;
    0x0001b15c lw v1, 0x54(sp)               |     v1 = *(var_54h);
    0x0001b160 lw a0, 0xa8(sp)               |     a0 = *(var_a8h);
    0x0001b164 sb v1, 0xac(sp)               |     *(var_ach) = v1;
    0x0001b168 lw v1, 0x58(sp)               |     v1 = *(var_58h);
    0x0001b16c sw a0, 4(v0)                  |     *((v0 + 1)) = a0;
    0x0001b170 sb v1, 0xad(sp)               |     *(var_adh) = v1;
    0x0001b174 lw v1, 0x5c(sp)               |     v1 = *(var_5ch);
    0x0001b178 sw s3, 0x10(v0)               |     *((v0 + 4)) = s3;
    0x0001b17c sb v1, 0xae(sp)               |     *(var_aeh) = v1;
    0x0001b180 lw v1, 0x60(sp)               |     v1 = *(var_60h);
    0x0001b184 sw s7, 0x14(v0)               |     *((v0 + 5)) = s7;
    0x0001b188 sb v1, 0xaf(sp)               |     *(var_afh) = v1;
    0x0001b18c lw v1, 0x64(sp)               |     v1 = *(var_64h);
    0x0001b190 lw a0, 0xac(sp)               |     a0 = *(var_ach);
    0x0001b194 sb v1, 0xb0(sp)               |     *(var_b0h) = v1;
    0x0001b198 lw v1, 0x68(sp)               |     v1 = *(var_68h);
    0x0001b19c sw a0, 8(v0)                  |     *((v0 + 2)) = a0;
    0x0001b1a0 sb v1, 0xb1(sp)               |     *(var_b1h) = v1;
    0x0001b1a4 lw a0, 0xb0(sp)               |     a0 = *(var_b0h);
    0x0001b1a8 lw v1, 0x40(sp)               |     v1 = *(var_40h_2);
    0x0001b1ac sw a0, 0xc(v0)                |     *((v0 + 3)) = a0;
    0x0001b1b0 addiu v1, v1, 1               |     v1++;
    0x0001b1b4 move a0, s6                   |     a0 = s6;
    0x0001b1b8 sw s3, 0xb4(sp)               |     *(var_b4h) = s3;
    0x0001b1bc sw s7, 0xb8(sp)               |     *(var_b8h) = s7;
    0x0001b1c0 move s0, v0                   |     s0 = v0;
    0x0001b1c4 sw v1, 0x40(sp)               |     *(var_40h_2) = v1;
    0x0001b1c8 jalr t9                       |     t9 ();
    0x0001b1cc lw gp, 0x38(sp)               |     gp = *(var_38h);
                                             |     if (s6 == v0) {
    0x0001b1d0 beq s6, v0, 0x1b00c           |         goto label_1;
                                             |     }
                                             | label_6:
    0x0001b1d4 lw t9, -0x7a28(gp)            |     t9 = sym.imp.close;
    0x0001b1d8 lw a0, 0x6c(sp)               |     a0 = *(var_6ch);
    0x0001b1dc jalr t9                       |     t9 ();
    0x0001b1e0 lw gp, 0x38(sp)               |     gp = *(var_38h);
    0x0001b1e4 lw t9, -0x7880(gp)            |     t9 = sym.imp.fclose;
    0x0001b1e8 move a0, s1                   |     a0 = s1;
    0x0001b1ec jalr t9                       |     t9 ();
    0x0001b1f0 lw v0, 0x40(sp)               |     v0 = *(var_40h_2);
    0x0001b1f4 lw gp, 0x38(sp)               |     gp = *(var_38h);
                                             |     if (v0 != 0) {
    0x0001b1f8 bnez v0, 0x1b254              |         goto label_8;
                                             |     }
    0x0001b1fc move s2, zero                 |     s2 = 0;
                                             |     do {
    0x0001b200 lw v0, 0x74(sp)               |         v0 = *(var_74h);
                                             | label_3:
    0x0001b204 sw s2, (v0)                   |         *(v0) = s2;
    0x0001b208 lw v0, 0x40(sp)               |         v0 = *(var_40h_2);
                                             | label_4:
    0x0001b20c lw v1, 0x70(sp)               |         v1 = *(var_70h);
    0x0001b210 lw a0, 0x1f4(sp)              |         a0 = *(var_1f4h);
    0x0001b214 lw v1, (v1)                   |         v1 = *(v1);
    0x0001b218 lw ra, 0x21c(sp)              |         ra = *(var_21ch);
                                             |         if (a0 != v1) {
    0x0001b21c bne a0, v1, 0x1b320           |             goto label_9;
                                             |         }
    0x0001b220 lw fp, 0x218(sp)              |         fp = *(var_218h);
    0x0001b224 lw s7, 0x214(sp)              |         s7 = *(var_214h);
    0x0001b228 lw s6, 0x210(sp)              |         s6 = *(var_210h);
    0x0001b22c lw s5, 0x20c(sp)              |         s5 = *(var_20ch);
    0x0001b230 lw s4, 0x208(sp)              |         s4 = *(var_208h);
    0x0001b234 lw s3, 0x204(sp)              |         s3 = *(var_204h);
    0x0001b238 lw s2, 0x200(sp)              |         s2 = *(var_200h);
    0x0001b23c lw s1, 0x1fc(sp)              |         s1 = *(var_1fch);
    0x0001b240 lw s0, 0x1f8(sp)              |         s0 = *(var_1f8h);
    0x0001b244 addiu sp, sp, 0x220           |         
    0x0001b248 jr ra                         |         return v0;
                                             | label_7:
    0x0001b24c addiu s7, zero, -1            |         s7 = -1;
    0x0001b250 b 0x1b118                     |         goto label_2;
                                             | label_8:
    0x0001b254 addiu a0, zero, 0x94          |         a0 = 0x94;
    0x0001b258 lw t9, -0x781c(gp)            |         t9 = sym.imp.malloc;
    0x0001b25c mul a0, v0, a0                |         __asm ("mul a0, v0, a0");
    0x0001b260 jalr t9                       |         t9 ();
    0x0001b264 move s2, v0                   |         s2 = v0;
    0x0001b268 lw gp, 0x38(sp)               |         gp = *(var_38h);
                                             |         if (v0 == 0) {
    0x0001b26c beqz v0, 0x1b2f4              |             goto label_10;
                                             |         }
    0x0001b270 addiu s1, v0, 0x84            |         s1 = v0 + 0x84;
    0x0001b274 beqz s0, 0x1b200              |         
                                             |     } while (s0 == 0);
                                             |     do {
    0x0001b278 addiu v0, s0, 4               |         v0 = s0 + 4;
    0x0001b27c addiu s1, s1, 0x94            |         s1 += 0x94;
    0x0001b280 lwl v1, 3(v0)                 |         __asm ("lwl v1, 3(v0)");
    0x0001b284 lw t9, -0x781c(gp)            |         t9 = sym.imp.malloc;
    0x0001b288 addiu a0, zero, 6             |         a0 = 6;
    0x0001b28c lwr v1, (v0)                  |         __asm ("lwr v1, (v0)");
    0x0001b290 sw v1, -0x94(s1)              |         *((s1 - 37)) = v1;
    0x0001b294 jalr t9                       |         t9 ();
    0x0001b298 addiu v1, s0, 8               |         v1 = s0 + 8;
    0x0001b29c lw gp, 0x38(sp)               |         gp = *(var_38h);
    0x0001b2a0 sw v0, -0x90(s1)              |         *((s1 - 36)) = v0;
    0x0001b2a4 lwl a1, 3(v1)                 |         __asm ("lwl a1, 3(v1)");
    0x0001b2a8 lw t9, -0x7940(gp)            |         t9 = sym.imp.free;
    0x0001b2ac move a0, s0                   |         a0 = s0;
    0x0001b2b0 lwr a1, (v1)                  |         __asm ("lwr a1, (v1)");
    0x0001b2b4 sw a1, (v0)                   |         *(v0) = a1;
    0x0001b2b8 lbu a1, 4(v1)                 |         a1 = *((v1 + 4));
    0x0001b2bc sb a1, 4(v0)                  |         *((v0 + 4)) = a1;
    0x0001b2c0 lbu v1, 5(v1)                 |         v1 = *((v1 + 5));
    0x0001b2c4 sb v1, 5(v0)                  |         *((v0 + 5)) = v1;
    0x0001b2c8 lw v0, 0x10(s0)               |         v0 = *((s0 + 4));
    0x0001b2cc lw v1, (s0)                   |         v1 = *(s0);
    0x0001b2d0 sw v0, -0x8c(s1)              |         *((s1 - 35)) = v0;
    0x0001b2d4 lw v0, 0x14(s0)               |         v0 = *((s0 + 5));
    0x0001b2d8 move s0, v1                   |         s0 = v1;
    0x0001b2dc sw v0, -0x88(s1)              |         *((s1 - 34)) = v0;
    0x0001b2e0 jalr t9                       |         t9 ();
    0x0001b2e4 lw gp, 0x38(sp)               |         gp = *(var_38h);
    0x0001b2e8 bnez s0, 0x1b278              |         
                                             |     } while (s0 != 0);
    0x0001b2ec lw v0, 0x74(sp)               |     v0 = *(var_74h);
    0x0001b2f0 b 0x1b204                     |     goto label_3;
                                             | label_10:
    0x0001b2f4 addiu v0, zero, -1            |     v0 = -1;
                                             |     if (s0 == 0) {
    0x0001b2f8 beqz s0, 0x1b20c              |         goto label_4;
                                             |     }
                                             |     do {
    0x0001b2fc lw v0, (s0)                   |         v0 = *(s0);
    0x0001b300 lw t9, -0x7940(gp)            |         t9 = sym.imp.free;
    0x0001b304 move a0, s0                   |         a0 = s0;
    0x0001b308 move s0, v0                   |         s0 = v0;
    0x0001b30c jalr t9                       |         t9 ();
    0x0001b310 lw gp, 0x38(sp)               |         gp = *(var_38h);
    0x0001b314 bnez s0, 0x1b2fc              |         
                                             |     } while (s0 != 0);
                                             | label_5:
    0x0001b318 addiu v0, zero, -1            |     v0 = -1;
    0x0001b31c b 0x1b20c                     |     goto label_4;
                                             | label_9:
    0x0001b320 lw t9, -0x790c(gp)            |     t9 = sym.imp.__stack_chk_fail;
    0x0001b324 jalr t9                       |     t9 ();
    0x0001b328 nop                           |     
                                             | }
    ; assembly                               | /* r2dec pseudo code output */
                                             | /* /logs/firmware/unblob_extracted/firmware_extract/4325012-58052244.squashfs_v4_le_extract/usr/sbin/snmpd @ 0x1b814 */
                                             | #include <stdint.h>
                                             |  
    ; (fcn) sym.ip_list_routes ()            | void ip_list_routes () {
    0x0001b814 lui gp, 3                     |     
    0x0001b818 addiu gp, gp, 0x5d7c          |     
    0x0001b81c addu gp, gp, t9               |     gp += t9;
    0x0001b820 lw v0, -0x77a4(gp)            |     v0 = *((gp - 7657));
    0x0001b824 addiu sp, sp, -0x1c8          |     
    0x0001b828 lw a1, -0x7fdc(gp)            |     a1 = *(gp);
    0x0001b82c sw v0, 0x2c(sp)               |     *(var_2ch) = v0;
    0x0001b830 sw a0, 0x30(sp)               |     *(var_30h) = a0;
    0x0001b834 lw v0, (v0)                   |     v0 = *(v0);
    0x0001b838 lw a0, -0x7fdc(gp)            |     a0 = *(gp);
    0x0001b83c lw t9, -0x77a0(gp)            |     t9 = sym.imp.fopen;
    0x0001b840 sw gp, 0x20(sp)               |     *(var_20h) = gp;
    0x0001b844 sw ra, 0x1c4(sp)              |     *(var_1c4h) = ra;
    0x0001b848 sw fp, 0x1c0(sp)              |     *(var_1c0h) = fp;
    0x0001b84c sw s7, 0x1bc(sp)              |     *(var_1bch) = s7;
    0x0001b850 sw s6, 0x1b8(sp)              |     *(var_1b8h) = s6;
    0x0001b854 sw s5, 0x1b4(sp)              |     *(var_1b4h) = s5;
    0x0001b858 sw s4, 0x1b0(sp)              |     *(var_1b0h) = s4;
    0x0001b85c sw s3, 0x1ac(sp)              |     *(var_1ach) = s3;
    0x0001b860 sw s2, 0x1a8(sp)              |     *(var_1a8h) = s2;
    0x0001b864 sw s1, 0x1a4(sp)              |     *(var_1a4h) = s1;
    0x0001b868 sw s0, 0x1a0(sp)              |     *(var_1a0h) = s0;
    0x0001b86c addiu a1, a1, 0x73dc          |     a1 += 0x73dc;
                                             |     /* str._proc_net_route */
    0x0001b870 addiu a0, a0, 0x4454          |     a0 += 0x4454;
    0x0001b874 sw v0, 0x19c(sp)              |     *(var_19ch) = v0;
    0x0001b878 jalr t9                       |     t9 ();
    0x0001b87c nop                           |     
    0x0001b880 lw gp, 0x20(sp)               |     gp = *(var_20h);
                                             |     if (v0 == 0) {
    0x0001b884 beqz v0, 0x1baf8              |         goto label_4;
                                             |     }
    0x0001b888 move s0, v0                   |     s0 = v0;
    0x0001b88c move s1, zero                 |     s1 = 0;
    0x0001b890 addiu s6, sp, 0x9c            |     s6 = sp + 0x9c;
    0x0001b894 b 0x1b89c                     |     
                                             |     while (s6 == v0) {
    0x0001b898 addiu s1, s1, 1               |         s1++;
    0x0001b89c lw t9, -0x7810(gp)            |         t9 = sym.imp.fgets;
    0x0001b8a0 move a2, s0                   |         a2 = s0;
    0x0001b8a4 addiu a1, zero, 0x100         |         a1 = aav.0x00000100;
    0x0001b8a8 move a0, s6                   |         a0 = s6;
    0x0001b8ac jalr t9                       |         t9 ();
    0x0001b8b0 lw gp, 0x20(sp)               |         gp = *(var_20h);
    0x0001b8b4 beq s6, v0, 0x1b898           |         
                                             |     }
    0x0001b8b8 slt s2, zero, s1              |     s2 = (0 < s1) ? 1 : 0;
    0x0001b8bc addiu v0, zero, 1             |     v0 = 1;
    0x0001b8c0 lw t9, -0x7750(gp)            |     t9 = sym.imp.rewind;
                                             |     if (s2 == 0) {
    0x0001b8c4 movn v0, s1, s2               |         v0 = s1;
                                             |     }
    0x0001b8c8 addiu s2, v0, -1              |     s2 = v0 + -1;
    0x0001b8cc move a0, s0                   |     a0 = s0;
    0x0001b8d0 jalr t9                       |     t9 ();
    0x0001b8d4 lw gp, 0x20(sp)               |     gp = *(var_20h);
                                             |     if (s2 == 0) {
    0x0001b8d8 beqz s2, 0x1bad0              |         goto label_5;
                                             |     }
    0x0001b8dc lw t9, -0x7774(gp)            |     t9 = sym.imp.socket;
    0x0001b8e0 move a2, zero                 |     a2 = 0;
    0x0001b8e4 addiu a1, zero, 1             |     a1 = 1;
    0x0001b8e8 addiu a0, zero, 2             |     a0 = 2;
    0x0001b8ec sb zero, 0x9b(sp)             |     *(var_9bh) = 0;
    0x0001b8f0 jalr t9                       |     t9 ();
    0x0001b8f4 move s5, v0                   |     s5 = v0;
    0x0001b8f8 lw gp, 0x20(sp)               |     gp = *(var_20h);
                                             |     if (v0 < 0) {
    0x0001b8fc bltz v0, 0x1bae8              |         goto label_6;
                                             |     }
    0x0001b900 sll a0, s2, 2                 |     a0 = s2 << 2;
    0x0001b904 lw t9, -0x781c(gp)            |     t9 = sym.imp.malloc;
    0x0001b908 addu a0, a0, s2               |     a0 += s2;
    0x0001b90c sll a0, a0, 5                 |     a0 <<= 5;
    0x0001b910 jalr t9                       |     t9 ();
    0x0001b914 sw v0, 0x34(sp)               |     *(var_34h_3) = v0;
    0x0001b918 lw gp, 0x20(sp)               |     gp = *(var_20h);
    0x0001b91c move s1, v0                   |     s1 = v0;
                                             |     if (v0 == 0) {
    0x0001b920 beqz v0, 0x1bad8              |         goto label_7;
                                             |     }
    0x0001b924 lw s3, -0x7fdc(gp)            |     s3 = *(gp);
    0x0001b928 addiu s7, sp, 0x60            |     s7 = sp + 0x60;
    0x0001b92c addiu fp, sp, 0x8c            |     fp = sp + 0x8c;
    0x0001b930 addiu s4, sp, 0x80            |     s4 = sp + 0x80;
                                             |     /* str._15s__x__x__x__u__d__d__x__d__d__d_n */
    0x0001b934 addiu s3, s3, 0x4464          |     s3 += 0x4464;
                                             |     do {
    0x0001b938 lw t9, -0x7810(gp)            |         t9 = sym.imp.fgets;
    0x0001b93c move a2, s0                   |         a2 = s0;
    0x0001b940 addiu a1, zero, 0x100         |         a1 = aav.0x00000100;
    0x0001b944 move a0, s6                   |         a0 = s6;
    0x0001b948 jalr t9                       |         t9 ();
    0x0001b94c lw gp, 0x20(sp)               |         gp = *(var_20h);
                                             |         if (s6 != v0) {
    0x0001b950 bne s6, v0, 0x1ba48           |             goto label_8;
                                             |         }
                                             | label_0:
    0x0001b954 addiu v0, s1, 0x94            |         v0 = s1 + 0x94;
    0x0001b958 sw v0, 0x18(sp)               |         *(var_18h_6) = v0;
    0x0001b95c addiu v0, sp, 0x38            |         v0 = sp + 0x38;
    0x0001b960 lw t9, -0x78e0(gp)            |         t9 = sym.imp.__isoc99_sscanf;
    0x0001b964 sw v0, 0x14(sp)               |         *(var_14h_2) = v0;
    0x0001b968 addiu v0, sp, 0x70            |         v0 = sp + 0x70;
    0x0001b96c move a0, s6                   |         a0 = s6;
    0x0001b970 sw s4, 0x1c(sp)               |         *(var_1ch_5) = s4;
    0x0001b974 sw v0, 0x10(sp)               |         *(var_10h_6) = v0;
    0x0001b978 move a3, s7                   |         a3 = s7;
    0x0001b97c move a2, fp                   |         a2 = fp;
    0x0001b980 move a1, s3                   |         a1 = s3;
    0x0001b984 jalr t9                       |         t9 ();
    0x0001b988 addiu a0, zero, 6             |         a0 = 6;
    0x0001b98c lw gp, 0x20(sp)               |         gp = *(var_20h);
    0x0001b990 bne v0, a0, 0x1b938           |         
                                             |     } while (v0 != a0);
    0x0001b994 lw a1, 0x60(sp)               |     a1 = *(var_60h_3);
    0x0001b998 lw v0, 0x38(sp)               |     v0 = *(var_38h_3);
    0x0001b99c sw a1, 0x84(s1)               |     *((s1 + 33)) = a1;
    0x0001b9a0 lw a1, 0x70(sp)               |     a1 = *(var_70h_3);
    0x0001b9a4 andi a0, v0, 1                |     a0 = v0 & 1;
    0x0001b9a8 sw a1, 0x88(s1)               |     *((s1 + 34)) = a1;
    0x0001b9ac lw a1, 0x80(sp)               |     a1 = *(var_80h_2);
    0x0001b9b0 sw a1, 0x8c(s1)               |     *((s1 + 35)) = a1;
                                             |     if (a0 == 0) {
    0x0001b9b4 beqz a0, 0x1bab8              |         goto label_9;
                                             |     }
    0x0001b9b8 andi t2, v0, 2                |     t2 = v0 & 2;
    0x0001b9bc addiu a1, zero, 4             |     a1 = 4;
    0x0001b9c0 addiu a0, zero, 3             |     a0 = 3;
                                             |     if (t2 == 0) {
    0x0001b9c4 movn a0, a1, t2               |         a0 = a1;
                                             |     }
    0x0001b9c8 move t2, a0                   |     t2 = a0;
                                             | label_1:
    0x0001b9cc andi v0, v0, 0x10             |     v0 &= 0x10;
    0x0001b9d0 addiu a1, zero, 4             |     a1 = 4;
    0x0001b9d4 addiu a0, zero, 2             |     a0 = 2;
                                             |     if (v0 == 0) {
    0x0001b9d8 movn a0, a1, v0               |         a0 = a1;
                                             |     }
    0x0001b9dc lw t9, -0x789c(gp)            |     t9 = sym.imp.__strcpy_chk
    0x0001b9e0 move v0, a0                   |     v0 = a0;
    0x0001b9e4 addiu a3, sp, 0x3c            |     a3 = sp + 0x3c;
    0x0001b9e8 move a0, a3                   |     a0 = a3;
    0x0001b9ec addiu a2, zero, 0x10          |     a2 = 0x10;
    0x0001b9f0 move a1, fp                   |     a1 = fp;
    0x0001b9f4 sw t2, 0x98(s1)               |     *((s1 + 38)) = t2;
    0x0001b9f8 sw v0, 0x9c(s1)               |     *((s1 + 39)) = v0;
    0x0001b9fc jalr t9                       |     t9 ();
    0x0001ba00 lw gp, 0x20(sp)               |     gp = *(var_20h);
    0x0001ba04 move a2, v0                   |     a2 = v0;
    0x0001ba08 ori a1, zero, 0x8933          |     a1 = 0x8933;
    0x0001ba0c lw t9, -0x7a70(gp)            |     t9 = sym.imp.ioctl;
    0x0001ba10 move a0, s5                   |     a0 = s5;
    0x0001ba14 jalr t9                       |     t9 ();
    0x0001ba18 lw gp, 0x20(sp)               |     gp = *(var_20h);
                                             |     if (v0 < 0) {
    0x0001ba1c bltz v0, 0x1bac0              |         goto label_10;
                                             |     }
    0x0001ba20 lw v0, 0x4c(sp)               |     v0 = *(var_4ch_4);
    0x0001ba24 addiu s1, s1, 0xa0            |     s1 += 0xa0;
    0x0001ba28 sw v0, -0x10(s1)              |     *((s1 - 4)) = v0;
                                             | label_2:
    0x0001ba2c lw t9, -0x7810(gp)            |     t9 = sym.imp.fgets;
    0x0001ba30 move a2, s0                   |     a2 = s0;
    0x0001ba34 addiu a1, zero, 0x100         |     a1 = aav.0x00000100;
    0x0001ba38 move a0, s6                   |     a0 = s6;
    0x0001ba3c jalr t9                       |     t9 ();
    0x0001ba40 lw gp, 0x20(sp)               |     gp = *(var_20h);
                                             |     if (s6 == v0) {
    0x0001ba44 beq s6, v0, 0x1b954           |         goto label_0;
                                             |     }
                                             | label_8:
    0x0001ba48 lw t9, -0x7a28(gp)            |     t9 = sym.imp.close;
    0x0001ba4c move a0, s5                   |     a0 = s5;
    0x0001ba50 jalr t9                       |     t9 ();
    0x0001ba54 lw gp, 0x20(sp)               |     gp = *(var_20h);
                                             |     do {
    0x0001ba58 lw v0, 0x30(sp)               |         v0 = *(var_30h);
    0x0001ba5c lw v1, 0x34(sp)               |         v1 = *(var_34h_3);
    0x0001ba60 lw t9, -0x7880(gp)            |         t9 = sym.imp.fclose;
    0x0001ba64 sw v1, (v0)                   |         *(v0) = v1;
    0x0001ba68 move a0, s0                   |         a0 = s0;
    0x0001ba6c jalr t9                       |         t9 ();
    0x0001ba70 lw gp, 0x20(sp)               |         gp = *(var_20h);
                                             | label_3:
    0x0001ba74 lw v0, 0x2c(sp)               |         v0 = *(var_2ch);
    0x0001ba78 lw a0, 0x19c(sp)              |         a0 = *(var_19ch);
    0x0001ba7c lw v1, (v0)                   |         v1 = *(v0);
    0x0001ba80 move v0, s2                   |         v0 = s2;
                                             |         if (a0 != v1) {
    0x0001ba84 bne a0, v1, 0x1bb00           |             goto label_11;
                                             |         }
    0x0001ba88 lw ra, 0x1c4(sp)              |         ra = *(var_1c4h);
    0x0001ba8c lw fp, 0x1c0(sp)              |         fp = *(var_1c0h);
    0x0001ba90 lw s7, 0x1bc(sp)              |         s7 = *(var_1bch);
    0x0001ba94 lw s6, 0x1b8(sp)              |         s6 = *(var_1b8h);
    0x0001ba98 lw s5, 0x1b4(sp)              |         s5 = *(var_1b4h);
    0x0001ba9c lw s4, 0x1b0(sp)              |         s4 = *(var_1b0h);
    0x0001baa0 lw s3, 0x1ac(sp)              |         s3 = *(var_1ach);
    0x0001baa4 lw s2, 0x1a8(sp)              |         s2 = *(var_1a8h);
    0x0001baa8 lw s1, 0x1a4(sp)              |         s1 = *(var_1a4h);
    0x0001baac lw s0, 0x1a0(sp)              |         s0 = *(var_1a0h);
    0x0001bab0 addiu sp, sp, 0x1c8           |         
    0x0001bab4 jr ra                         |         return v0;
                                             | label_9:
    0x0001bab8 addiu t2, zero, 2             |         t2 = 2;
    0x0001babc b 0x1b9cc                     |         goto label_1;
                                             | label_10:
    0x0001bac0 addiu v0, zero, -1            |         v0 = -1;
    0x0001bac4 sw v0, 0x90(s1)               |         *((s1 + 36)) = v0;
    0x0001bac8 addiu s1, s1, 0xa0            |         s1 += 0xa0;
    0x0001bacc b 0x1ba2c                     |         goto label_2;
                                             | label_5:
    0x0001bad0 sw zero, 0x34(sp)             |         *(var_34h_3) = 0;
    0x0001bad4 b 0x1ba58                     |         
                                             |     } while (1);
                                             | label_7:
    0x0001bad8 lw t9, -0x7a28(gp)            |     t9 = sym.imp.close;
    0x0001badc move a0, s5                   |     a0 = s5;
    0x0001bae0 jalr t9                       |     t9 ();
    0x0001bae4 lw gp, 0x20(sp)               |     gp = *(var_20h);
                                             | label_6:
    0x0001bae8 lw t9, -0x7880(gp)            |     t9 = sym.imp.fclose;
    0x0001baec move a0, s0                   |     a0 = s0;
    0x0001baf0 jalr t9                       |     t9 ();
    0x0001baf4 lw gp, 0x20(sp)               |     gp = *(var_20h);
                                             | label_4:
    0x0001baf8 addiu s2, zero, -1            |     s2 = -1;
    0x0001bafc b 0x1ba74                     |     goto label_3;
                                             | label_11:
    0x0001bb00 lw t9, -0x790c(gp)            |     t9 = sym.imp.__stack_chk_fail;
    0x0001bb04 jalr t9                       |     t9 ();
    0x0001bb08 nop                           |     
                                             | }

[*] Function strcpy used 3 times snmpd