[*] Binary protection state of openssl
Full RELRO Canary found NX disabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function printf tear down of openssl
; assembly | /* r2dec pseudo code output */
| /* /logs/firmware/unblob_extracted/firmware_extract/4325012-58052244.squashfs_v4_le_extract/usr/bin/openssl @ 0x2d650 */
| #include <stdint.h>
|
; (fcn) fcn.0002d650 () | void fcn_0002d650 () {
0x0002d650 lui gp, 8 |
0x0002d654 addiu gp, gp, 0x6c60 |
0x0002d658 addu gp, gp, t9 | gp += t9;
0x0002d65c addiu sp, sp, -0x440 |
0x0002d660 addiu v0, sp, 0x448 | v0 = sp + aav.0x00000448;
0x0002d664 sw s1, 0x430(sp) | *(var_430h) = s1;
0x0002d668 sw s0, 0x42c(sp) | *(var_42ch) = s0;
0x0002d66c lw s1, -0x7f9c(gp) | s1 = *((gp - 8167));
0x0002d670 lw s0, -0x7300(gp) | s0 = *(gp);
0x0002d674 sw gp, 0x18(sp) | *(var_18h) = gp;
0x0002d678 lw v1, -0x244c(s1) | v1 = *((s1 - 2323));
0x0002d67c lw t0, (s0) | t0 = *(s0);
0x0002d680 sw s2, 0x434(sp) | *(var_434h) = s2;
0x0002d684 sw ra, 0x43c(sp) | *(var_43ch) = ra;
0x0002d688 sw s3, 0x438(sp) | *(var_438h) = s3;
0x0002d68c sw a0, 0x440(sp) | *(arg_440h) = a0;
0x0002d690 move s2, a1 | s2 = a1;
0x0002d694 sw a2, 0x448(sp) | *(arg_448h) = a2;
0x0002d698 sw a3, 0x44c(sp) | *(arg_44ch) = a3;
0x0002d69c sw t0, 0x424(sp) | *(var_424h) = t0;
0x0002d6a0 sw v0, 0x20(sp) | *(var_20h) = v0;
| if (v1 != 0) {
0x0002d6a4 bnez v1, 0x2d724 | goto label_2;
| }
0x0002d6a8 lw s1, -0x7fcc(gp) | s1 = *(gp);
0x0002d6ac lw v0, -0x7f9c(gp) | v0 = *((gp - 8167));
| label_0:
0x0002d6b0 lw a1, -0x7fd4(gp) | a1 = *(gp);
0x0002d6b4 lw t9, -0x6834(gp) | t9 = sym.imp.BIO_printf
0x0002d6b8 lw a0, (s1) | a0 = *(s1);
0x0002d6bc lw a2, -0x2448(v0) | a2 = *((v0 - 2322));
| /* str._s:_ */
0x0002d6c0 addiu a1, a1, -0x764 | a1 += -0x764;
0x0002d6c4 jalr t9 | t9 ();
0x0002d6c8 lw gp, 0x18(sp) | gp = *(var_18h);
0x0002d6cc lw a2, 0x20(sp) | a2 = *(var_20h);
0x0002d6d0 lw a0, (s1) | a0 = *(s1);
0x0002d6d4 lw t9, -0x7b6c(gp) | t9 = sym.imp.BIO_vprintf
0x0002d6d8 move a1, s2 | a1 = s2;
0x0002d6dc jalr t9 | t9 ();
0x0002d6e0 lw gp, 0x18(sp) | gp = *(var_18h);
0x0002d6e4 lw a0, (s1) | a0 = *(s1);
0x0002d6e8 lw a1, -0x7fd4(gp) | a1 = *(gp);
0x0002d6ec lw t9, -0x6834(gp) | t9 = sym.imp.BIO_printf
0x0002d6f0 addiu a1, a1, 0x7800 | a1 += 0x7800;
0x0002d6f4 jalr t9 | t9 ();
0x0002d6f8 lw gp, 0x18(sp) | gp = *(var_18h);
| do {
0x0002d6fc lw v1, 0x424(sp) | v1 = *(var_424h);
0x0002d700 lw v0, (s0) | v0 = *(s0);
0x0002d704 lw ra, 0x43c(sp) | ra = *(var_43ch);
| if (v1 != v0) {
0x0002d708 bne v1, v0, 0x2d7bc | goto label_3;
| }
0x0002d70c lw s3, 0x438(sp) | s3 = *(var_438h);
0x0002d710 lw s2, 0x434(sp) | s2 = *(var_434h);
0x0002d714 lw s1, 0x430(sp) | s1 = *(var_430h);
0x0002d718 lw s0, 0x42c(sp) | s0 = *(var_42ch);
0x0002d71c addiu sp, sp, 0x440 |
0x0002d720 jr ra | return v0;
| label_2:
0x0002d724 lw t9, -0x6de0(gp) | t9 = sym.imp.__vsnprintf_chk
0x0002d728 addiu s3, sp, 0x24 | s3 = sp + 0x24;
0x0002d72c sw a1, 0x10(sp) | *(var_10h) = a1;
0x0002d730 sw v0, 0x14(sp) | *(var_14h) = v0;
0x0002d734 addiu a3, zero, 0x400 | a3 = aav.0x00000400;
0x0002d738 addiu a2, zero, 1 | a2 = 1;
0x0002d73c addiu a1, zero, 0x400 | a1 = aav.0x00000400;
0x0002d740 move a0, s3 | a0 = s3;
0x0002d744 jalr t9 | t9 ();
0x0002d748 lw gp, 0x18(sp) | gp = *(var_18h);
| if (v0 > 0) {
0x0002d74c bgtz v0, 0x2d774 | goto label_4;
| }
0x0002d750 lw v0, 0x440(sp) | v0 = *(arg_440h);
0x0002d754 slti v0, v0, 3 | v0 = (v0 < 3) ? 1 : 0;
| if (v0 == 0) {
0x0002d758 beql v0, zero, 0x2d7a4 | goto label_5;
| }
0x0002d75c lw a0, -0x7fc0(gp) | a0 = *(gp);
| label_1:
0x0002d760 lw v0, -0x244c(s1) | v0 = *((s1 - 2323));
0x0002d764 lw s1, -0x7fcc(gp) | s1 = *(gp);
0x0002d768 bnez v0, 0x2d6fc |
| } while (v0 != 0);
0x0002d76c lw v0, -0x7f9c(gp) | v0 = *((gp - 8167));
0x0002d770 b 0x2d6b0 | goto label_0;
| label_4:
0x0002d774 lw a2, -0x7fd4(gp) | a2 = *(gp);
0x0002d778 lw t9, -0x73e8(gp) | t9 = sym.imp.__syslog_chk;
0x0002d77c lw a0, 0x440(sp) | a0 = *(arg_440h);
0x0002d780 move a3, s3 | a3 = s3;
| /* esilref: '&s' */
0x0002d784 addiu a2, a2, -0x738 | a2 += -0x738;
0x0002d788 addiu a1, zero, 1 | a1 = 1;
0x0002d78c jalr t9 | t9 ();
0x0002d790 lw v0, 0x440(sp) | v0 = *(arg_440h);
0x0002d794 slti v0, v0, 3 | v0 = (v0 < 3) ? 1 : 0;
0x0002d798 lw gp, 0x18(sp) | gp = *(var_18h);
| if (v0 != 0) {
0x0002d79c bnez v0, 0x2d760 | goto label_1;
| }
0x0002d7a0 lw a0, -0x7fc0(gp) | a0 = *(gp);
| label_5:
0x0002d7a4 lw t9, -0x72c4(gp) | t9 = sym.imp.ERR_print_errors_cb;
0x0002d7a8 addiu a1, sp, 0x440 | a1 = sp + aav.0x00000440;
0x0002d7ac addiu a0, a0, -0x2ac0 | a0 += -0x2ac0;
0x0002d7b0 jalr t9 | t9 ();
0x0002d7b4 lw gp, 0x18(sp) | gp = *(var_18h);
0x0002d7b8 b 0x2d760 | goto label_1;
| label_3:
0x0002d7bc lw t9, -0x7590(gp) | t9 = sym.imp.__stack_chk_fail;
0x0002d7c0 jalr t9 | t9 ();
0x0002d7c4 nop |
| }
; assembly | /* r2dec pseudo code output */
| /* /logs/firmware/unblob_extracted/firmware_extract/4325012-58052244.squashfs_v4_le_extract/usr/bin/openssl @ 0x5d300 */
| #include <stdint.h>
|
; (fcn) fcn.0005d300 () | void fcn_0005d300 () {
0x0005d300 lui gp, 5 |
0x0005d304 addiu gp, gp, 0x6fb0 |
0x0005d308 addu gp, gp, t9 | gp += t9;
0x0005d30c addiu sp, sp, -0x30 |
0x0005d310 lw t9, -0x6834(gp) | t9 = sym.imp.BIO_printf
0x0005d314 sw s0, 0x20(sp) | *(var_20h) = s0;
0x0005d318 lw s0, -0x7300(gp) | s0 = *(gp);
0x0005d31c sw s1, 0x24(sp) | *(var_24h) = s1;
0x0005d320 move s1, a1 | s1 = a1;
0x0005d324 lw v0, (s0) | v0 = *(s0);
0x0005d328 lw a1, -0x7fd0(gp) | a1 = *((gp - 8180));
0x0005d32c sw a3, 0x3c(sp) | *(arg_3ch) = a3;
0x0005d330 lw a3, -0x7fd4(gp) | a3 = *(gp);
0x0005d334 addiu v1, sp, 0x3c | v1 = sp + 0x3c;
0x0005d338 sw gp, 0x10(sp) | *(var_10h) = gp;
0x0005d33c sw v1, 0x18(sp) | *(var_18h) = v1;
0x0005d340 sw ra, 0x2c(sp) | *(var_2ch) = ra;
0x0005d344 sw s2, 0x28(sp) | *(var_28h) = s2;
0x0005d348 addiu a3, a3, -0x1d54 | a3 += -0x1d54;
0x0005d34c move s2, a2 | s2 = a2;
| /* esilref: '&*s' */
0x0005d350 addiu a1, a1, -0x5250 | a1 += -0x5250;
0x0005d354 move a2, a0 | a2 = a0;
0x0005d358 sw v0, 0x1c(sp) | *(var_1ch) = v0;
0x0005d35c move a0, s1 | a0 = s1;
0x0005d360 jalr t9 | t9 ();
0x0005d364 lw gp, 0x10(sp) | gp = *(var_10h);
0x0005d368 lw a2, 0x18(sp) | a2 = *(var_18h);
0x0005d36c move a0, s1 | a0 = s1;
0x0005d370 lw t9, -0x7b6c(gp) | t9 = sym.imp.BIO_vprintf
0x0005d374 move a1, s2 | a1 = s2;
0x0005d378 move s1, v0 | s1 = v0;
0x0005d37c jalr t9 | t9 ();
0x0005d380 lw a0, 0x1c(sp) | a0 = *(var_1ch);
0x0005d384 lw v1, (s0) | v1 = *(s0);
0x0005d388 lw gp, 0x10(sp) | gp = *(var_10h);
0x0005d38c addu v0, s1, v0 | v0 = s1 + v0;
| if (a0 == v1) {
0x0005d390 bne a0, v1, 0x5d3ac |
0x0005d394 lw ra, 0x2c(sp) | ra = *(var_2ch);
0x0005d398 lw s2, 0x28(sp) | s2 = *(var_28h);
0x0005d39c lw s1, 0x24(sp) | s1 = *(var_24h);
0x0005d3a0 lw s0, 0x20(sp) | s0 = *(var_20h);
0x0005d3a4 addiu sp, sp, 0x30 |
0x0005d3a8 jr ra | return v0;
| }
0x0005d3ac lw t9, -0x7590(gp) | t9 = sym.imp.__stack_chk_fail;
0x0005d3b0 jalr t9 | t9 ();
0x0005d3b4 nop |
| }
[*] Function printf used 7 times openssl
