[*] Binary protection state of factorydefault.cgi
Full RELRO Canary found NX disabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function printf tear down of factorydefault.cgi
; assembly | /* r2dec pseudo code output */
| /* /logs/firmware/unblob_extracted/firmware_extract/4325012-58052244.squashfs_v4_le_extract/usr/html/axis-cgi/factorydefault.cgi @ 0x870 */
| #include <stdint.h>
|
; (fcn) main () | int32_t main () {
| /* [13] -r-x section size 880 named .text */
0x00000870 lui gp, 2 |
0x00000874 addiu gp, gp, -0x7860 |
0x00000878 addu gp, gp, t9 | gp += t9;
0x0000087c lw v0, -0x7f94(gp) | v0 = *((gp - 8165));
0x00000880 addiu sp, sp, -0x50 |
0x00000884 lw t9, -0x7fa0(gp) | t9 = sym.imp.sd_bus_open_system;
0x00000888 lw v0, (v0) | v0 = *(v0);
0x0000088c addiu a0, sp, 0x30 | a0 = sp + 0x30;
0x00000890 sw gp, 0x28(sp) | *(var_28h) = gp;
0x00000894 sw ra, 0x4c(sp) | *(var_4ch) = ra;
0x00000898 sw zero, 0x30(sp) | *(var_30h) = 0;
0x0000089c sw v0, 0x44(sp) | *(var_44h) = v0;
0x000008a0 jalr t9 | t9 ();
0x000008a4 nop |
0x000008a8 lw gp, 0x28(sp) | gp = *(var_28h);
| if (v0 < 0) {
0x000008ac bltz v0, 0x98c | goto label_2;
| }
0x000008b0 lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x000008b4 lw a3, -0x7fdc(gp) | a3 = *((gp - 8183));
0x000008b8 addiu v0, v0, 0xd10 | v0 += str.Soft;
0x000008bc sw v0, 0x20(sp) | *(var_20h) = v0;
0x000008c0 lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x000008c4 lw a2, -0x7fdc(gp) | a2 = *((gp - 8183));
0x000008c8 addiu v0, v0, 0xd18 | v0 += 0xd18;
0x000008cc sw v0, 0x1c(sp) | *(var_1ch) = v0;
0x000008d0 addiu v0, sp, 0x34 | v0 = sp + 0x34;
0x000008d4 sw v0, 0x18(sp) | *(var_18h) = v0;
0x000008d8 addiu v0, sp, 0x38 | v0 = sp + 0x38;
0x000008dc sw v0, 0x14(sp) | *(var_14h) = v0;
0x000008e0 lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x000008e4 lw t9, -0x7f98(gp) | t9 = sym.imp.sd_bus_call_method;
0x000008e8 addiu a3, a3, 0xcd8 | a3 += str.com.axis.FirmwareManager1;
0x000008ec addiu v0, v0, 0xd1c | v0 += str.FactoryDefault;
0x000008f0 lw a0, 0x30(sp) | a0 = *(var_30h);
0x000008f4 sw v0, 0x10(sp) | *(var_10h) = v0;
0x000008f8 addiu a2, a2, 0xcf4 | a2 += str._com_axis_FirmwareManager1;
0x000008fc move a1, a3 | a1 = a3;
0x00000900 sw zero, 0x38(sp) | *(var_38h) = 0;
0x00000904 sw zero, 0x3c(sp) | *(var_3ch) = 0;
0x00000908 sw zero, 0x40(sp) | *(var_40h) = 0;
0x0000090c sw zero, 0x34(sp) | *(var_34h) = 0;
0x00000910 jalr t9 | t9 ();
0x00000914 lw gp, 0x28(sp) | gp = *(var_28h);
| if (v0 >= 0) {
0x00000918 bltz v0, 0x95c |
0x0000091c lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00000920 lw t9, -0x7f9c(gp) | t9 = sym.imp.getenv;
0x00000924 addiu a0, a0, 0xd2c | a0 += str.SERVER_NAME;
0x00000928 jalr t9 | t9 ();
0x0000092c lw gp, 0x28(sp) | gp = *(var_28h);
| if (v0 == 0) {
0x00000930 beqz v0, 0x9a8 | goto label_3;
| }
| label_1:
0x00000934 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00000938 lw t9, -0x7fb0(gp) | t9 = sym.imp.__printf_chk
0x0000093c addiu a0, zero, 1 | a0 = 1;
0x00000940 move a2, v0 | a2 = v0;
0x00000944 addiu a1, a1, 0xd38 | a1 += str.Cache_Control:_no_cache_r_nPragma:_no_cache_r_nExpires:_Thu__01_Dec_1994_16:00:00_GMT_r_nContent_Type:_text_html_r_n_r_n_html__head__meta_http_equiv_refresh__content_0_URL_admin_factoryMessage.shtml_server_s____head__body___body___html_;
0x00000948 jalr t9 | t9 ();
0x0000094c lw gp, 0x28(sp) | gp = *(var_28h);
0x00000950 lw t9, -0x7fa8(gp) | t9 = sym.imp.exit;
0x00000954 move a0, zero | a0 = 0;
0x00000958 jalr t9 | t9 ();
| }
0x0000095c lw a2, 0x3c(sp) | a2 = *(var_3ch);
| if (a2 == 0) {
0x00000960 beql a2, zero, 0x9a0 | goto label_4;
| }
0x00000964 lw a2, -0x7fdc(gp) | a2 = *((gp - 8183));
| label_0:
0x00000968 lw t9, -0x7fb0(gp) | t9 = sym.imp.__printf_chk
0x0000096c addiu a0, zero, 1 | a0 = 1;
| do {
0x00000970 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00000974 addiu a1, a1, 0xc98 | a1 += str.Status:_500_Internal_Error_r_nContent_Type:_text_plain_r_n_r_n_s_r_n;
0x00000978 jalr t9 | t9 ();
0x0000097c lw gp, 0x28(sp) | gp = *(var_28h);
0x00000980 lw t9, -0x7fa8(gp) | t9 = sym.imp.exit;
0x00000984 addiu a0, zero, 1 | a0 = 1;
0x00000988 jalr t9 | t9 ();
| label_2:
0x0000098c lw a2, -0x7fdc(gp) | a2 = *((gp - 8183));
0x00000990 lw t9, -0x7fb0(gp) | t9 = sym.imp.__printf_chk
0x00000994 addiu a0, zero, 1 | a0 = 1;
0x00000998 addiu a2, a2, 0xc78 | a2 += str.Unable_to_contact_DBus_service.;
0x0000099c b 0x970 |
| } while (1);
| label_4:
0x000009a0 addiu a2, a2, 0xc78 | a2 += str.Unable_to_contact_DBus_service.;
0x000009a4 b 0x968 | goto label_0;
| label_3:
0x000009a8 lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x000009ac addiu v0, v0, 0xcd4 | v0 += 0xcd4;
0x000009b0 b 0x934 | goto label_1;
| }
[*] Function printf used 4 times factorydefault.cgi
