[*] Binary protection state of firmwareupgrade.cgi
Full RELRO Canary found NX disabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function printf tear down of firmwareupgrade.cgi
; assembly | /* r2dec pseudo code output */
| /* /logs/firmware/unblob_extracted/firmware_extract/4325012-58052244.squashfs_v4_le_extract/usr/html/axis-cgi/firmwareupgrade.cgi @ 0x1230 */
| #include <stdint.h>
|
; (fcn) fcn.00001230 () | void fcn_00001230 () {
0x00001230 lui gp, 2 |
0x00001234 addiu gp, gp, -0x7220 |
0x00001238 addu gp, gp, t9 | gp += t9;
0x0000123c addiu sp, sp, -0x20 |
0x00001240 sw gp, 0x10(sp) | *(var_10h) = gp;
0x00001244 sw ra, 0x1c(sp) | *(var_1ch) = ra;
| if (a0 == 0) {
0x00001248 beql a0, zero, 0x1278 | goto label_0;
| }
0x0000124c lw a2, -0x7fdc(gp) | a2 = *((gp - 8183));
0x00001250 move a2, a0 | a2 = a0;
| do {
0x00001254 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00001258 lw t9, -0x7fa4(gp) | t9 = sym.imp.__printf_chk
0x0000125c addiu a0, zero, 1 | a0 = 1;
0x00001260 addiu a1, a1, 0x1718 | a1 += str.Status:_500_Internal_Error_r_nContent_Type:_text_plain_r_n_r_n_s_r_n;
0x00001264 jalr t9 | t9 ();
0x00001268 lw gp, 0x10(sp) | gp = *(var_10h);
0x0000126c lw t9, -0x7f7c(gp) | t9 = sym.imp.exit;
0x00001270 addiu a0, zero, 1 | a0 = 1;
0x00001274 jalr t9 | t9 ();
| label_0:
0x00001278 addiu a2, a2, 0x16f8 | a2 += str.Unable_to_contact_DBus_service.;
0x0000127c b 0x1254 |
| } while (1);
| }
; assembly | /* r2dec pseudo code output */
| /* /logs/firmware/unblob_extracted/firmware_extract/4325012-58052244.squashfs_v4_le_extract/usr/html/axis-cgi/firmwareupgrade.cgi @ 0xb80 */
| #include <stdint.h>
|
; (fcn) main () | int32_t main () {
| /* [13] -r-x section size 2480 named .text */
0x00000b80 lui gp, 2 |
0x00000b84 addiu gp, gp, -0x6b70 |
0x00000b88 addu gp, gp, t9 | gp += t9;
0x00000b8c lw v0, -0x7f58(gp) | v0 = *((gp - 8150));
0x00000b90 addiu sp, sp, -0x1088 |
0x00000b94 lw t9, -0x7f5c(gp) | t9 = sym.imp.signal;
0x00000b98 lw v0, (v0) | v0 = *(v0);
0x00000b9c addiu a1, zero, 1 | a1 = 1;
0x00000ba0 sw gp, 0x30(sp) | *(var_30h) = gp;
0x00000ba4 sw ra, 0x1084(sp) | *(var_1084h) = ra;
0x00000ba8 addiu a0, zero, 0xd | a0 = 0xd;
0x00000bac sw s6, 0x1080(sp) | *(var_1080h) = s6;
0x00000bb0 sw s5, 0x107c(sp) | *(var_107ch) = s5;
0x00000bb4 sw s4, 0x1078(sp) | *(var_1078h) = s4;
0x00000bb8 sw s3, 0x1074(sp) | *(var_1074h) = s3;
0x00000bbc sw s2, 0x1070(sp) | *(var_1070h) = s2;
0x00000bc0 sw s1, 0x106c(sp) | *(var_106ch) = s1;
0x00000bc4 sw s0, 0x1068(sp) | *(var_1068h) = s0;
0x00000bc8 sw v0, 0x1064(sp) | *(var_1064h) = v0;
0x00000bcc jalr t9 | t9 ();
0x00000bd0 nop |
0x00000bd4 lw gp, 0x30(sp) | gp = *(var_30h);
0x00000bd8 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00000bdc lw t9, -0x7f68(gp) | t9 = sym.imp.getenv;
0x00000be0 addiu a0, a0, 0x177c | a0 += str.REQUEST_METHOD;
0x00000be4 jalr t9 | t9 ();
0x00000be8 lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 != 0) {
0x00000bec beqz v0, 0xc0c |
0x00000bf0 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00000bf4 lw t9, -0x7f40(gp) | t9 = sym.imp.strcmp;
0x00000bf8 addiu a1, a1, 0x178c | a1 += str.POST;
0x00000bfc move a0, v0 | a0 = v0;
0x00000c00 jalr t9 | t9 ();
0x00000c04 lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 == 0) {
0x00000c08 beqz v0, 0xc30 | goto label_6;
| }
| }
0x00000c0c lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00000c10 lw t9, -0x7f6c(gp) | t9 = sym.imp.puts;
0x00000c14 addiu a0, a0, 0x1794 | a0 += str.Status:_405_Method_Not_Allowed_r_nContent_Type:_text_plain_r_n_r_nInvalid_method__only_POST_supported._r;
| label_2:
0x00000c18 jalr t9 | t9 ();
0x00000c1c nop |
0x00000c20 lw gp, 0x30(sp) | gp = *(var_30h);
0x00000c24 lw t9, -0x7f7c(gp) | t9 = sym.imp.exit;
0x00000c28 addiu a0, zero, 1 | a0 = 1;
0x00000c2c jalr t9 | t9 ();
| label_6:
0x00000c30 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00000c34 lw t9, -0x7f68(gp) | t9 = sym.imp.getenv;
0x00000c38 addiu a0, a0, 0x17f8 | a0 += str.QUERY_STRING;
0x00000c3c jalr t9 | t9 ();
0x00000c40 move s1, v0 | s1 = v0;
0x00000c44 lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 == 0) {
0x00000c48 beqz v0, 0xdf4 | goto label_7;
| }
0x00000c4c lb v0, (v0) | v0 = *(v0);
0x00000c50 move s0, zero | s0 = 0;
| if (v0 == 0) {
0x00000c54 beqz v0, 0xd18 | goto label_8;
| }
0x00000c58 lw s4, -0x7fdc(gp) | s4 = *((gp - 8183));
0x00000c5c lw s5, -0x7fdc(gp) | s5 = *((gp - 8183));
0x00000c60 addiu s3, sp, 0x60 | s3 = sp + 0x60;
0x00000c64 addiu s4, s4, 0x1858 | s4 += str.typenormal;
0x00000c68 addiu s5, s5, 0x1864 | s5 += str.typefactorydefault;
0x00000c6c b 0xca8 |
| while (v0 != 0) {
0x00000c70 lw t9, -0x7f40(gp) | t9 = sym.imp.strcmp;
0x00000c74 move a1, s5 | a1 = s5;
0x00000c78 move a0, s3 | a0 = s3;
0x00000c7c jalr t9 | t9 ();
0x00000c80 lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 != 0) {
0x00000c84 bnez v0, 0xd68 | goto label_9;
| }
0x00000c88 addiu s0, zero, 1 | s0 = 1;
| if (s2 == 0) {
0x00000c8c beqz s2, 0xd18 | goto label_8;
| }
| label_0:
0x00000c90 addiu s1, s2, 1 | s1 = s2 + 1;
0x00000c94 lw t9, -0x7f9c(gp) | t9 = sym.imp.pipe;
| if (s1 == 0) {
0x00000c98 beqz s1, 0xd1c | goto label_10;
| }
0x00000c9c lb v0, 1(s2) | v0 = *((s2 + 1));
| if (v0 == 0) {
0x00000ca0 beqz v0, 0xd1c | goto label_10;
| }
0x00000ca4 nop |
0x00000ca8 lw t9, -0x7f84(gp) | t9 = sym.imp.strchr;
0x00000cac addiu a1, zero, 0x26 | a1 = 0x26;
0x00000cb0 move a0, s1 | a0 = s1;
0x00000cb4 jalr t9 | t9 ();
0x00000cb8 move s2, v0 | s2 = v0;
0x00000cbc lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 == 0) {
0x00000cc0 beqz v0, 0xd50 | goto label_11;
| }
0x00000cc4 subu s0, v0, s1 | __asm ("subu s0, v0, s1");
| label_1:
0x00000cc8 sltiu v0, s0, 0x40 | v0 = (s0 < 0x40) ? 1 : 0;
0x00000ccc lw t9, -0x7f70(gp) | t9 = sym.imp.__memcpy_chk;
| if (v0 == 0) {
0x00000cd0 beqz v0, 0xd68 | goto label_9;
| }
0x00000cd4 move a2, s0 | a2 = s0;
0x00000cd8 addiu a3, zero, 0x40 | a3 = 0x40;
0x00000cdc move a1, s1 | a1 = s1;
0x00000ce0 move a0, s3 | a0 = s3;
0x00000ce4 jalr t9 | t9 ();
0x00000ce8 lw gp, 0x30(sp) | gp = *(var_30h);
0x00000cec addiu v0, sp, 0x1068 | v0 = sp + 0x1068;
0x00000cf0 addu s0, v0, s0 | s0 = v0 + s0;
0x00000cf4 lw t9, -0x7f40(gp) | t9 = sym.imp.strcmp;
0x00000cf8 move a1, s4 | a1 = s4;
0x00000cfc move a0, s1 | a0 = s1;
0x00000d00 sb zero, -0x1008(s0) | *((s0 - 4104)) = 0;
0x00000d04 jalr t9 | t9 ();
0x00000d08 lw gp, 0x30(sp) | gp = *(var_30h);
0x00000d0c bnez v0, 0xc70 |
| }
0x00000d10 move s0, zero | s0 = 0;
| if (s2 != 0) {
0x00000d14 bnez s2, 0xc90 | goto label_0;
| }
| do {
| label_8:
0x00000d18 lw t9, -0x7f9c(gp) | t9 = sym.imp.pipe;
| label_10:
0x00000d1c addiu a0, sp, 0x50 | a0 = sp + 0x50;
0x00000d20 jalr t9 | t9 ();
0x00000d24 lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 >= 0) {
0x00000d28 bltz v0, 0xd40 |
0x00000d2c lw t9, -0x7f9c(gp) | t9 = sym.imp.pipe;
0x00000d30 addiu a0, sp, 0x58 | a0 = sp + 0x58;
0x00000d34 jalr t9 | t9 ();
0x00000d38 lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 >= 0) {
0x00000d3c bgez v0, 0xd90 | goto label_12;
| }
| }
0x00000d40 lw t9, -0x7fdc(gp) | t9 = *((gp - 8183));
| label_5:
0x00000d44 addiu t9, t9, 0x1230 | t9 += fcn.00001230;
0x00000d48 move a0, zero | a0 = 0;
0x00000d4c bal 0x1230 | fcn_00001230 ();
| label_11:
0x00000d50 lw t9, -0x7f88(gp) | t9 = sym.imp.strlen;
0x00000d54 move a0, s1 | a0 = s1;
0x00000d58 jalr t9 | t9 ();
0x00000d5c move s0, v0 | s0 = v0;
0x00000d60 lw gp, 0x30(sp) | gp = *(var_30h);
0x00000d64 b 0xcc8 | goto label_1;
| label_9:
0x00000d68 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00000d6c lw t9, -0x7fa4(gp) | t9 = sym.imp.__printf_chk
0x00000d70 addiu a0, zero, 1 | a0 = 1;
0x00000d74 move a2, s3 | a2 = s3;
0x00000d78 addiu a1, a1, 0x1808 | a1 += str.Status:_400_Bad_Request_r_nContent_Type:_text_plain_r_n_r_nInvalid_parameter:__s_r_n;
0x00000d7c jalr t9 | t9 ();
0x00000d80 lw gp, 0x30(sp) | gp = *(var_30h);
0x00000d84 lw t9, -0x7f7c(gp) | t9 = sym.imp.exit;
0x00000d88 addiu a0, zero, 1 | a0 = 1;
0x00000d8c jalr t9 | t9 ();
| label_12:
0x00000d90 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00000d94 lw t9, -0x7f68(gp) | t9 = sym.imp.getenv;
0x00000d98 addiu a0, a0, 0x1878 | a0 += str.CONTENT_LENGTH;
0x00000d9c jalr t9 | t9 ();
0x00000da0 lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 == 0) {
0x00000da4 beqz v0, 0xdfc | goto label_13;
| }
0x00000da8 lw t9, -0x7f80(gp) | t9 = sym.imp.strtoul;
0x00000dac move a2, zero | a2 = 0;
0x00000db0 move a1, zero | a1 = 0;
0x00000db4 move a0, v0 | a0 = v0;
0x00000db8 jalr t9 | t9 ();
0x00000dbc lw gp, 0x30(sp) | gp = *(var_30h);
0x00000dc0 lw t9, -0x7f94(gp) | t9 = sym.imp.__errno_location;
0x00000dc4 move s1, v0 | s1 = v0;
0x00000dc8 jalr t9 | t9 ();
0x00000dcc move s2, v0 | s2 = v0;
0x00000dd0 lw v0, (v0) | v0 = *(v0);
0x00000dd4 lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 == 0) {
0x00000dd8 bnez v0, 0xde4 |
0x00000ddc lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
| if (s1 == 0) {
0x00000de0 bnel s1, zero, 0xe0c | goto label_14;
| }
| }
0x00000de4 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00000de8 lw t9, -0x7f6c(gp) | t9 = sym.imp.puts;
0x00000dec addiu a0, a0, 0x18d8 | a0 += str.Status:_400_Bad_Request_r_nContent_Type:_text_plain_r_n_r_nInvalid_Content_Length._r;
0x00000df0 b 0xc18 | goto label_2;
| label_7:
0x00000df4 move s0, zero | s0 = 0;
0x00000df8 b 0xd18 |
| } while (1);
| label_13:
0x00000dfc lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00000e00 lw t9, -0x7f6c(gp) | t9 = sym.imp.puts;
0x00000e04 addiu a0, a0, 0x1888 | a0 += str.Status:_400_Bad_Request_r_nContent_Type:_text_plain_r_n_r_nMissing_Content_Length._r;
0x00000e08 b 0xc18 | goto label_2;
| label_14:
0x00000e0c lw t9, -0x7f68(gp) | t9 = sym.imp.getenv;
0x00000e10 addiu a0, a0, 0x1928 | a0 += str.CONTENT_TYPE;
0x00000e14 jalr t9 | t9 ();
0x00000e18 lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 == 0) {
0x00000e1c beqz v0, 0x1034 | goto label_15;
| }
0x00000e20 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00000e24 lw t9, -0x7fb0(gp) | t9 = sym.imp.strncmp;
0x00000e28 addiu a2, zero, 0xa | a2 = 0xa;
0x00000e2c addiu a1, a1, 0x1938 | a1 += str.multipart_;
0x00000e30 move a0, v0 | a0 = v0;
0x00000e34 jalr t9 | t9 ();
0x00000e38 lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 != 0) {
0x00000e3c bnez v0, 0x1034 | goto label_15;
| }
0x00000e40 sltiu s5, s1, 0x1001 | s5 = (s1 < 0x1001) ? 1 : 0;
0x00000e44 addiu v0, zero, 0x1000 | v0 = 0x1000;
| if (s5 == 0) {
0x00000e48 movn v0, s1, s5 | v0 = s1;
| }
0x00000e4c move s5, v0 | s5 = v0;
0x00000e50 move s4, zero | s4 = 0;
0x00000e54 addiu s3, sp, 0x60 | s3 = sp + 0x60;
0x00000e58 addiu s6, zero, 4 | s6 = 4;
0x00000e5c lw t9, -0x7f48(gp) | t9 = sym.imp.read;
| do {
0x00000e60 subu a2, s5, s4 | __asm ("subu a2, s5, s4");
0x00000e64 addu a1, s3, s4 | a1 = s3 + s4;
0x00000e68 move a0, zero | a0 = 0;
0x00000e6c jalr t9 | t9 ();
0x00000e70 lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 < 0) {
0x00000e74 bltz v0, 0x103c | goto label_16;
| }
0x00000e78 addu s4, s4, v0 | s4 += v0;
| if (v0 == 0) {
0x00000e7c beqz v0, 0xe8c | goto label_17;
| }
| label_3:
0x00000e80 sltu v0, s4, s5 | v0 = (s4 < s5) ? 1 : 0;
0x00000e84 lw t9, -0x7f48(gp) | t9 = sym.imp.read;
0x00000e88 bnez v0, 0xe60 |
| } while (v0 != 0);
| label_17:
0x00000e8c addiu v0, sp, 0x1068 | v0 = sp + 0x1068;
0x00000e90 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00000e94 addu v0, v0, s4 | v0 += s4;
0x00000e98 lw t9, -0x7f3c(gp) | t9 = sym.imp.strstr;
0x00000e9c addiu a1, a1, 0x1978 | a1 += str._r_n_r_n;
0x00000ea0 move a0, s3 | a0 = s3;
0x00000ea4 sb zero, -0x1008(v0) | *((v0 - 4104)) = 0;
0x00000ea8 jalr t9 | t9 ();
0x00000eac lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 == 0) {
0x00000eb0 beqz v0, 0x10ac | goto label_18;
| }
0x00000eb4 addiu a1, v0, 4 | a1 = v0 + 4;
0x00000eb8 subu s3, a1, s3 | __asm ("subu s3, a1, s3");
0x00000ebc subu s4, s4, s3 | __asm ("subu s4, s4, s3");
0x00000ec0 lw t9, -0x7f90(gp) | t9 = sym.imp.write;
| if (s4 != 0) {
0x00000ec4 bnez s4, 0x1090 | goto label_19;
| }
| label_4:
0x00000ec8 subu s1, s1, s3 | __asm ("subu s1, s1, s3");
| do {
0x00000ecc lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00000ed0 lw t9, -0x7f6c(gp) | t9 = sym.imp.puts;
0x00000ed4 addiu a0, a0, 0x19dc | a0 += str.Content_Type:_text_plain_r_n_r;
0x00000ed8 jalr t9 | t9 ();
0x00000edc lw gp, 0x30(sp) | gp = *(var_30h);
0x00000ee0 lw v0, -0x7fa0(gp) | v0 = *((gp - 8168));
0x00000ee4 lw t9, -0x7f50(gp) | t9 = sym.imp.fflush;
0x00000ee8 lw a0, (v0) | a0 = *(v0);
0x00000eec jalr t9 | t9 ();
0x00000ef0 lw gp, 0x30(sp) | gp = *(var_30h);
0x00000ef4 addiu a0, sp, 0x3c | a0 = sp + 0x3c;
0x00000ef8 lw t9, -0x7f74(gp) | t9 = sym.imp.sd_bus_open_system;
0x00000efc sw zero, 0x3c(sp) | *(var_3ch) = 0;
0x00000f00 jalr t9 | t9 ();
0x00000f04 lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 < 0) {
0x00000f08 bltz v0, 0x1058 | goto label_20;
| }
0x00000f0c lw v0, 0x5c(sp) | v0 = *(var_5ch);
0x00000f10 lw a3, -0x7fdc(gp) | a3 = *((gp - 8183));
0x00000f14 sw v0, 0x28(sp) | *(var_28h) = v0;
0x00000f18 lw v0, 0x50(sp) | v0 = *(var_50h);
0x00000f1c lw a2, -0x7fdc(gp) | a2 = *((gp - 8183));
0x00000f20 sw v0, 0x24(sp) | *(var_24h) = v0;
0x00000f24 lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x00000f28 lw t9, -0x7f64(gp) | t9 = sym.imp.sd_bus_call_method;
0x00000f2c addiu v0, v0, 0x1a58 | v0 += str.ihhb;
0x00000f30 sw v0, 0x1c(sp) | *(var_1ch) = v0;
0x00000f34 addiu v0, sp, 0x40 | v0 = sp + 0x40;
0x00000f38 sw v0, 0x18(sp) | *(var_18h) = v0;
0x00000f3c addiu v0, sp, 0x44 | v0 = sp + 0x44;
0x00000f40 sw v0, 0x14(sp) | *(var_14h) = v0;
0x00000f44 lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x00000f48 addiu a3, a3, 0x1a20 | a3 += str.com.axis.FirmwareManager1;
0x00000f4c addiu v0, v0, 0x1a60 | v0 += str.UpgradeRaw;
0x00000f50 lw a0, 0x3c(sp) | a0 = *(var_3ch);
0x00000f54 sw s0, 0x2c(sp) | *(var_2ch) = s0;
0x00000f58 sw s1, 0x20(sp) | *(var_20h) = s1;
0x00000f5c sw v0, 0x10(sp) | *(var_10h) = v0;
0x00000f60 addiu a2, a2, 0x1a3c | a2 += str._com_axis_FirmwareManager1;
0x00000f64 move a1, a3 | a1 = a3;
0x00000f68 sw zero, 0x44(sp) | *(var_44h) = 0;
0x00000f6c sw zero, 0x48(sp) | *(var_48h) = 0;
0x00000f70 sw zero, 0x4c(sp) | *(var_4ch) = 0;
0x00000f74 sw zero, 0x40(sp) | *(var_40h) = 0;
0x00000f78 jalr t9 | t9 ();
0x00000f7c lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 < 0) {
0x00000f80 bltz v0, 0x1068 | goto label_21;
| }
0x00000f84 lw a0, 0x40(sp) | a0 = *(var_40h);
0x00000f88 lw t9, -0x7f98(gp) | t9 = sym.imp.sd_bus_message_unref;
| if (a0 != 0) {
0x00000f8c beqz a0, 0xf9c |
0x00000f90 jalr t9 | t9 ();
0x00000f94 nop |
0x00000f98 lw gp, 0x30(sp) | gp = *(var_30h);
| }
0x00000f9c lw a0, 0x3c(sp) | a0 = *(var_3ch);
0x00000fa0 lw t9, -0x7fa8(gp) | t9 = sym.imp.sd_bus_unref;
| if (a0 != 0) {
0x00000fa4 beqz a0, 0xfb4 |
0x00000fa8 jalr t9 | t9 ();
0x00000fac nop |
0x00000fb0 lw gp, 0x30(sp) | gp = *(var_30h);
| }
0x00000fb4 lw t9, -0x7fb4(gp) | t9 = sym.imp.close;
0x00000fb8 lw a0, 0x50(sp) | a0 = *(var_50h);
0x00000fbc jalr t9 | t9 ();
0x00000fc0 lw gp, 0x30(sp) | gp = *(var_30h);
0x00000fc4 lw t9, -0x7fb4(gp) | t9 = sym.imp.close;
0x00000fc8 lw a0, 0x5c(sp) | a0 = *(var_5ch);
0x00000fcc jalr t9 | t9 ();
0x00000fd0 lw gp, 0x30(sp) | gp = *(var_30h);
0x00000fd4 lw a1, 0x54(sp) | a1 = *(var_54h);
0x00000fd8 subu a2, s1, s4 | __asm ("subu a2, s1, s4");
0x00000fdc lw s0, -0x7fdc(gp) | s0 = *((gp - 8183));
0x00000fe0 addiu s0, s0, 0x1280 | s0 += fcn.00001280;
0x00000fe4 move t9, s0 | t9 = s0;
0x00000fe8 move a0, zero | a0 = 0;
0x00000fec bal 0x1280 | fcn_00001280 ();
0x00000ff0 lw gp, 0x30(sp) | gp = *(var_30h);
0x00000ff4 lw t9, -0x7fb4(gp) | t9 = sym.imp.close;
0x00000ff8 lw a0, 0x54(sp) | a0 = *(var_54h);
0x00000ffc jalr t9 | t9 ();
0x00001000 lw a0, 0x58(sp) | a0 = *(var_58h);
0x00001004 addiu a2, zero, -1 | a2 = -1;
0x00001008 move t9, s0 | t9 = s0;
0x0000100c addiu a1, zero, 1 | a1 = 1;
0x00001010 bal 0x1280 | fcn_00001280 ();
0x00001014 lw gp, 0x30(sp) | gp = *(var_30h);
0x00001018 lw t9, -0x7fb4(gp) | t9 = sym.imp.close;
0x0000101c lw a0, 0x58(sp) | a0 = *(var_58h);
0x00001020 jalr t9 | t9 ();
0x00001024 lw gp, 0x30(sp) | gp = *(var_30h);
0x00001028 lw t9, -0x7f7c(gp) | t9 = sym.imp.exit;
0x0000102c move a0, zero | a0 = 0;
0x00001030 jalr t9 | t9 ();
| label_15:
0x00001034 move s4, zero | s4 = 0;
0x00001038 b 0xecc |
| } while (1);
| label_16:
0x0000103c lw v0, (s2) | v0 = *(s2);
0x00001040 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
| if (v0 == s6) {
0x00001044 beq v0, s6, 0xe80 | goto label_3;
| }
0x00001048 lw t9, -0x7fdc(gp) | t9 = *((gp - 8183));
0x0000104c addiu t9, t9, 0x1230 | t9 += fcn.00001230;
0x00001050 addiu a0, a0, 0x1944 | a0 += str.Read_error_on_input_stream_before_firmware_image.;
0x00001054 bal 0x1230 | fcn_00001230 ();
| label_20:
0x00001058 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x0000105c lw t9, -0x7f6c(gp) | t9 = sym.imp.puts;
0x00001060 addiu a0, a0, 0x19f8 | a0 += str.Error:_Failed_to_open_DBus_connection.;
0x00001064 b 0xc18 | goto label_2;
| label_21:
0x00001068 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x0000106c lw t9, -0x7fa4(gp) | t9 = sym.imp.__printf_chk
0x00001070 lw a2, 0x48(sp) | a2 = *(var_48h);
0x00001074 addiu a0, zero, 1 | a0 = 1;
0x00001078 addiu a1, a1, 0x1a6c | a1 += str.Error:__s_n;
0x0000107c jalr t9 | t9 ();
0x00001080 lw gp, 0x30(sp) | gp = *(var_30h);
0x00001084 lw t9, -0x7f7c(gp) | t9 = sym.imp.exit;
0x00001088 move a0, zero | a0 = 0;
0x0000108c jalr t9 | t9 ();
| label_19:
0x00001090 lw a0, 0x54(sp) | a0 = *(var_54h);
0x00001094 move a2, s4 | a2 = s4;
0x00001098 jalr t9 | t9 ();
0x0000109c lw gp, 0x30(sp) | gp = *(var_30h);
| if (v0 == s4) {
0x000010a0 beq v0, s4, 0xec8 | goto label_4;
| }
0x000010a4 lw t9, -0x7fdc(gp) | t9 = *((gp - 8183));
0x000010a8 b 0xd44 | goto label_5;
| label_18:
0x000010ac lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x000010b0 lw t9, -0x7f6c(gp) | t9 = sym.imp.puts;
0x000010b4 addiu a0, a0, 0x1980 | a0 += str.Status:_400_Bad_Request_r_nContent_Type:_text_plain_r_n_r_nFormat_error_in_HTTP_multipart_data._r;
0x000010b8 b 0xc18 | goto label_2;
| }
[*] Function printf used 4 times firmwareupgrade.cgi
