[*] Binary protection state of httptest.cgi
Full RELRO Canary found NX disabled PIE enabled RPATH No RUNPATH No Symbols
[*] Function printf tear down of httptest.cgi
; assembly | /* r2dec pseudo code output */
| /* /logs/firmware/unblob_extracted/firmware_extract/4325012-58052244.squashfs_v4_le_extract/usr/html/axis-cgi/httptest.cgi @ 0x1b60 */
| #include <stdint.h>
|
; (fcn) fcn.00001b60 () | void fcn_00001b60 () {
0x00001b60 lui gp, 2 |
0x00001b64 addiu gp, gp, -0x6b40 |
0x00001b68 addu gp, gp, t9 | gp += t9;
0x00001b6c addiu sp, sp, -0x40 |
0x00001b70 lw t9, -0x7f30(gp) | t9 = sym.imp.g_strdup;
0x00001b74 sw s1, 0x30(sp) | *(var_30h) = s1;
0x00001b78 lw s1, -0x7f00(gp) | s1 = *((gp - 8128));
0x00001b7c sw gp, 0x18(sp) | *(var_18h) = gp;
0x00001b80 sw s3, 0x38(sp) | *(var_38h) = s3;
0x00001b84 lw v0, (s1) | v0 = *(s1);
0x00001b88 sw s2, 0x34(sp) | *(var_34h) = s2;
0x00001b8c sw s0, 0x2c(sp) | *(var_2ch) = s0;
0x00001b90 sw ra, 0x3c(sp) | *(var_3ch) = ra;
0x00001b94 move s2, a0 | s2 = a0;
0x00001b98 sw v0, 0x24(sp) | *(var_24h) = v0;
0x00001b9c move a0, a2 | a0 = a2;
0x00001ba0 move s3, a1 | s3 = a1;
0x00001ba4 jalr t9 | t9 ();
0x00001ba8 move s0, v0 | s0 = v0;
0x00001bac lw gp, 0x18(sp) | gp = *(var_18h);
| if (v0 == 0) {
0x00001bb0 beqz v0, 0x1c74 | goto label_0;
| }
0x00001bb4 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00001bb8 lw t9, -0x7f40(gp) | t9 = sym.imp.strtok_r;
0x00001bbc addiu a2, sp, 0x20 | a2 = sp + 0x20;
0x00001bc0 addiu a1, a1, 0x2320 | a1 += 0x2320;
0x00001bc4 move a0, v0 | a0 = v0;
0x00001bc8 jalr t9 | t9 ();
0x00001bcc lw gp, 0x18(sp) | gp = *(var_18h);
0x00001bd0 move a3, s3 | a3 = s3;
0x00001bd4 move a2, s2 | a2 = s2;
0x00001bd8 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00001bdc lw t9, -0x7eec(gp) | t9 = sym.imp.__printf_chk
0x00001be0 addiu a1, a1, 0x2060 | a1 += str.Status:__d__s_r_n;
0x00001be4 addiu a0, zero, 1 | a0 = 1;
0x00001be8 jalr t9 | t9 ();
0x00001bec lw gp, 0x18(sp) | gp = *(var_18h);
0x00001bf0 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00001bf4 lw t9, -0x7f7c(gp) | t9 = sym.imp.puts;
0x00001bf8 addiu a0, a0, 0x2070 | a0 += str.Content_Type:_text_plain_r;
0x00001bfc jalr t9 | t9 ();
0x00001c00 lw gp, 0x18(sp) | gp = *(var_18h);
0x00001c04 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00001c08 lw t9, -0x7f7c(gp) | t9 = sym.imp.puts;
0x00001c0c addiu a0, a0, 0x2088 | a0 += 0x2088;
0x00001c10 jalr t9 | t9 ();
0x00001c14 lw gp, 0x18(sp) | gp = *(var_18h);
0x00001c18 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00001c1c addiu a1, a1, 0x2054 | a1 += str._d__s__s_r_n;
| do {
0x00001c20 lw t9, -0x7eec(gp) | t9 = sym.imp.__printf_chk
0x00001c24 move a3, s3 | a3 = s3;
0x00001c28 move a2, s2 | a2 = s2;
0x00001c2c addiu a0, zero, 1 | a0 = 1;
0x00001c30 sw s0, 0x10(sp) | *(var_10h) = s0;
0x00001c34 jalr t9 | t9 ();
0x00001c38 lw gp, 0x18(sp) | gp = *(var_18h);
0x00001c3c lw t9, -0x7f64(gp) | t9 = sym.imp.g_free;
0x00001c40 move a0, s0 | a0 = s0;
0x00001c44 jalr t9 | t9 ();
0x00001c48 lw v1, 0x24(sp) | v1 = *(var_24h);
0x00001c4c lw v0, (s1) | v0 = *(s1);
0x00001c50 lw gp, 0x18(sp) | gp = *(var_18h);
| if (v1 != v0) {
0x00001c54 bne v1, v0, 0x1cc8 | goto label_1;
| }
0x00001c58 lw ra, 0x3c(sp) | ra = *(var_3ch);
0x00001c5c lw s3, 0x38(sp) | s3 = *(var_38h);
0x00001c60 lw s2, 0x34(sp) | s2 = *(var_34h);
0x00001c64 lw s1, 0x30(sp) | s1 = *(var_30h);
0x00001c68 lw s0, 0x2c(sp) | s0 = *(var_2ch);
0x00001c6c addiu sp, sp, 0x40 |
0x00001c70 jr ra | return v1;
| label_0:
0x00001c74 lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00001c78 lw t9, -0x7eec(gp) | t9 = sym.imp.__printf_chk
0x00001c7c addiu a1, a1, 0x2060 | a1 += str.Status:__d__s_r_n;
0x00001c80 move a3, s3 | a3 = s3;
0x00001c84 move a2, s2 | a2 = s2;
0x00001c88 addiu a0, zero, 1 | a0 = 1;
0x00001c8c jalr t9 | t9 ();
0x00001c90 lw gp, 0x18(sp) | gp = *(var_18h);
0x00001c94 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00001c98 lw t9, -0x7f7c(gp) | t9 = sym.imp.puts;
0x00001c9c addiu a0, a0, 0x2070 | a0 += str.Content_Type:_text_plain_r;
0x00001ca0 jalr t9 | t9 ();
0x00001ca4 lw gp, 0x18(sp) | gp = *(var_18h);
0x00001ca8 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00001cac lw t9, -0x7f7c(gp) | t9 = sym.imp.puts;
0x00001cb0 addiu a0, a0, 0x2088 | a0 += 0x2088;
0x00001cb4 jalr t9 | t9 ();
0x00001cb8 lw gp, 0x18(sp) | gp = *(var_18h);
0x00001cbc lw a1, -0x7fdc(gp) | a1 = *((gp - 8183));
0x00001cc0 addiu a1, a1, 0x2068 | a1 += 0x2068;
0x00001cc4 b 0x1c20 |
| } while (1);
| label_1:
0x00001cc8 lw t9, -0x7f50(gp) | t9 = sym.imp.__stack_chk_fail;
0x00001ccc jalr t9 | t9 ();
0x00001cd0 nop |
0x00001cd4 nop |
0x00001cd8 nop |
0x00001cdc nop |
| }
[*] Function printf used 4 times httptest.cgi
