[*] Binary protection state of streamprofile.cgi
Full RELRO Canary found NX disabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function fprintf tear down of streamprofile.cgi
; assembly | /* r2dec pseudo code output */
| /* /logs/firmware/unblob_extracted/firmware_extract/4325012-58052244.squashfs_v4_le_extract/usr/html/axis-cgi/streamprofile.cgi @ 0x3f70 */
| #include <stdint.h>
|
; (fcn) fcn.00003f70 () | void fcn_00003f70 () {
0x00003f70 lui gp, 2 |
0x00003f74 addiu gp, gp, -0x6f60 |
0x00003f78 addu gp, gp, t9 | gp += t9;
0x00003f7c addiu sp, sp, -0x30 |
0x00003f80 lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x00003f84 sw s0, 0x24(sp) | *(var_24h) = s0;
0x00003f88 lw s0, -0x7f58(gp) | s0 = *((gp - 8150));
0x00003f8c sw s1, 0x28(sp) | *(var_28h) = s1;
0x00003f90 lw a3, -0x7fdc(gp) | a3 = *((gp - 8183));
0x00003f94 lw s1, -0x7fdc(gp) | s1 = *((gp - 8183));
0x00003f98 lw a0, (s0) | a0 = *(s0);
0x00003f9c lw t9, -0x7ec8(gp) | t9 = sym.imp.__fprintf_chk
0x00003fa0 addiu v0, v0, 0x48e0 | v0 += str.no_cache__no_store__max_age0;
0x00003fa4 sw ra, 0x2c(sp) | *(var_2ch) = ra;
0x00003fa8 sw gp, 0x18(sp) | *(var_18h) = gp;
0x00003fac addiu a2, s1, 0x48d4 | a2 = s1 + str._s:__s_r_n;
0x00003fb0 addiu a3, a3, 0x48c4 | a3 += str.Cache_Control;
0x00003fb4 sw v0, 0x10(sp) | *(var_10h) = v0;
0x00003fb8 addiu a1, zero, 1 | a1 = 1;
0x00003fbc jalr t9 | t9 ();
0x00003fc0 lw gp, 0x18(sp) | gp = *(var_18h);
0x00003fc4 lw a0, (s0) | a0 = *(s0);
0x00003fc8 addiu a2, s1, 0x48d4 | a2 = s1 + str._s:__s_r_n;
0x00003fcc lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x00003fd0 lw a3, -0x7fdc(gp) | a3 = *((gp - 8183));
0x00003fd4 lw t9, -0x7ec8(gp) | t9 = sym.imp.__fprintf_chk
0x00003fd8 addiu v0, v0, 0x4908 | v0 += str.no_cache;
0x00003fdc addiu a3, a3, 0x4900 | a3 += str.Pragma;
0x00003fe0 addiu a1, zero, 1 | a1 = 1;
0x00003fe4 sw v0, 0x10(sp) | *(var_10h) = v0;
0x00003fe8 jalr t9 | t9 ();
0x00003fec lw gp, 0x18(sp) | gp = *(var_18h);
0x00003ff0 lw a0, (s0) | a0 = *(s0);
0x00003ff4 addiu a2, s1, 0x48d4 | a2 = s1 + str._s:__s_r_n;
0x00003ff8 lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x00003ffc lw a3, -0x7fdc(gp) | a3 = *((gp - 8183));
0x00004000 lw t9, -0x7ec8(gp) | t9 = sym.imp.__fprintf_chk
0x00004004 addiu v0, v0, 0x491c | v0 += str.Sun__21_Oct_1990_18:00:00_GMT;
0x00004008 sw v0, 0x10(sp) | *(var_10h) = v0;
0x0000400c addiu a3, a3, 0x4914 | a3 += str.Expires;
0x00004010 addiu a1, zero, 1 | a1 = 1;
0x00004014 jalr t9 | t9 ();
0x00004018 lw gp, 0x18(sp) | gp = *(var_18h);
0x0000401c lw a0, (s0) | a0 = *(s0);
0x00004020 lw ra, 0x2c(sp) | ra = *(var_2ch);
0x00004024 lw s1, 0x28(sp) | s1 = *(var_28h);
0x00004028 lw s0, 0x24(sp) | s0 = *(var_24h);
0x0000402c lw t9, -0x7f10(gp) | t9 = sym.imp.fflush;
0x00004030 addiu sp, sp, 0x30 |
0x00004034 jr t9 | return t9 ();
| }
; assembly | /* r2dec pseudo code output */
| /* /logs/firmware/unblob_extracted/firmware_extract/4325012-58052244.squashfs_v4_le_extract/usr/html/axis-cgi/streamprofile.cgi @ 0x16fc */
| #include <stdint.h>
|
; (fcn) sym.handle_request () | void handle_request () {
0x000016fc lui gp, 2 |
0x00001700 addiu gp, gp, -0x46ec |
0x00001704 addu gp, gp, t9 | gp += t9;
0x00001708 addiu sp, sp, -0x148 |
0x0000170c lw t9, -0x7f1c(gp) | t9 = sym.imp.json_loads;
0x00001710 sw s5, 0x138(sp) | *(var_138h) = s5;
0x00001714 lw s5, -0x7f34(gp) | s5 = *((gp - 8141));
0x00001718 sw gp, 0x10(sp) | *(var_10h) = gp;
0x0000171c sw s2, 0x12c(sp) | *(var_12ch) = s2;
0x00001720 lw v0, (s5) | v0 = *(s5);
0x00001724 sw ra, 0x144(sp) | *(var_144h) = ra;
0x00001728 sw s7, 0x140(sp) | *(var_140h) = s7;
0x0000172c sw s6, 0x13c(sp) | *(var_13ch) = s6;
0x00001730 sw s4, 0x134(sp) | *(var_134h) = s4;
0x00001734 sw s3, 0x130(sp) | *(var_130h) = s3;
0x00001738 sw s1, 0x128(sp) | *(var_128h) = s1;
0x0000173c sw s0, 0x124(sp) | *(var_124h) = s0;
0x00001740 move s2, a1 | s2 = a1;
0x00001744 addiu a2, sp, 0x20 | a2 = sp + 0x20;
0x00001748 move a1, zero | a1 = 0;
0x0000174c sw v0, 0x11c(sp) | *(var_11ch) = v0;
0x00001750 jalr t9 | t9 ();
0x00001754 nop |
0x00001758 lw gp, 0x10(sp) | gp = *(var_10h);
| if (v0 == 0) {
0x0000175c beqz v0, 0x1a18 | goto label_4;
| }
0x00001760 move s0, v0 | s0 = v0;
0x00001764 lw v0, (v0) | v0 = *(v0);
0x00001768 addiu v1, zero, 1 | v1 = 1;
| if (v0 == 0) {
0x0000176c beqz v0, 0x18ec | goto label_5;
| }
0x00001770 lw t9, -0x7f3c(gp) | t9 = sym.imp.json_array;
| if (v0 == v1) {
0x00001774 beq v0, v1, 0x17f8 | goto label_6;
| }
| label_1:
0x00001778 lw t9, -0x7f10(gp) | t9 = sym.imp.fflush;
| label_0:
0x0000177c move a0, s2 | a0 = s2;
0x00001780 jalr t9 | t9 ();
0x00001784 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001788 addiu v0, zero, -1 | v0 = -1;
| label_2:
0x0000178c lw a0, 4(s0) | a0 = *((s0 + 1));
0x00001790 addiu v1, zero, -1 | v1 = -1;
| if (a0 == v1) {
0x00001794 beq a0, v1, 0x17c0 | goto label_3;
| }
0x00001798 nop |
0x0000179c sync | __asm ("sync");
| do {
0x000017a0 ll v1, 4(s0) | __asm ("ll v1, 4(s0)");
0x000017a4 addiu at, v1, -1 | at = v1 + -1;
0x000017a8 sc at, 4(s0) | __asm ("sc at, 4(s0)");
0x000017ac addiu v1, v1, -1 | v1 += -1;
0x000017b0 beqz at, 0x17a0 |
| } while (at == 0);
0x000017b4 sync | __asm ("sync");
0x000017b8 lw t9, -0x7f48(gp) | t9 = sym.imp.json_delete;
| if (v1 == 0) {
0x000017bc beqz v1, 0x1a00 | goto label_7;
| }
| label_3:
0x000017c0 lw a0, 0x11c(sp) | a0 = *(var_11ch);
0x000017c4 lw v1, (s5) | v1 = *(s5);
0x000017c8 lw ra, 0x144(sp) | ra = *(var_144h);
| if (a0 != v1) {
0x000017cc bne a0, v1, 0x1a4c | goto label_8;
| }
0x000017d0 lw s7, 0x140(sp) | s7 = *(var_140h);
0x000017d4 lw s6, 0x13c(sp) | s6 = *(var_13ch);
0x000017d8 lw s5, 0x138(sp) | s5 = *(var_138h);
0x000017dc lw s4, 0x134(sp) | s4 = *(var_134h);
0x000017e0 lw s3, 0x130(sp) | s3 = *(var_130h);
0x000017e4 lw s2, 0x12c(sp) | s2 = *(var_12ch);
0x000017e8 lw s1, 0x128(sp) | s1 = *(var_128h);
0x000017ec lw s0, 0x124(sp) | s0 = *(var_124h);
0x000017f0 addiu sp, sp, 0x148 |
0x000017f4 jr ra | return v0;
| label_6:
0x000017f8 jalr t9 | t9 ();
0x000017fc nop |
0x00001800 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001804 move a0, s0 | a0 = s0;
0x00001808 lw t9, -0x7ee4(gp) | t9 = sym.imp.json_array_size;
0x0000180c move s1, v0 | s1 = v0;
0x00001810 jalr t9 | t9 ();
0x00001814 move s7, v0 | s7 = v0;
0x00001818 lw gp, 0x10(sp) | gp = *(var_10h);
| if (v0 == 0) {
0x0000181c beqz v0, 0x1918 | goto label_9;
| }
0x00001820 lw s6, -0x7fdc(gp) | s6 = *((gp - 8183));
0x00001824 move s3, zero | s3 = 0;
0x00001828 addiu s6, s6, 0x14d0 | s6 += fcn.000014d0;
0x0000182c b 0x183c |
| while (v0 != 0) {
0x00001830 addiu s3, s3, 1 | s3++;
| if (s7 == s3) {
0x00001834 beq s7, s3, 0x1918 | goto label_9;
| }
0x00001838 nop |
0x0000183c lw t9, -0x7f2c(gp) | t9 = sym.imp.json_object;
0x00001840 jalr t9 | t9 ();
0x00001844 nop |
0x00001848 lw gp, 0x10(sp) | gp = *(var_10h);
0x0000184c move a1, s3 | a1 = s3;
0x00001850 move a0, s0 | a0 = s0;
0x00001854 lw t9, -0x7edc(gp) | t9 = sym.imp.json_array_get;
0x00001858 move s4, v0 | s4 = v0;
0x0000185c jalr t9 | t9 ();
0x00001860 move a0, v0 | a0 = v0;
0x00001864 move t9, s6 | t9 = s6;
0x00001868 move a1, s4 | a1 = s4;
0x0000186c bal 0x14d0 | fcn_000014d0 ();
0x00001870 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001874 move a1, s4 | a1 = s4;
0x00001878 lw t9, -0x7eec(gp) | t9 = sym.imp.json_array_append_new;
0x0000187c move a0, s1 | a0 = s1;
0x00001880 jalr t9 | t9 ();
0x00001884 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001888 lw t9, -0x7f54(gp) | t9 = sym.imp.json_object_size;
0x0000188c move a0, s4 | a0 = s4;
0x00001890 jalr t9 | t9 ();
0x00001894 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001898 bnez v0, 0x1830 |
| }
0x0000189c lw t9, -0x7f10(gp) | t9 = sym.imp.fflush;
| if (s1 == 0) {
0x000018a0 beqz s1, 0x177c | goto label_0;
| }
0x000018a4 lw v1, 4(s1) | v1 = *((s1 + 1));
0x000018a8 addiu v0, zero, -1 | v0 = -1;
| if (v1 == v0) {
0x000018ac beq v1, v0, 0x177c | goto label_0;
| }
0x000018b0 nop |
0x000018b4 sync | __asm ("sync");
| do {
0x000018b8 ll v0, 4(s1) | __asm ("ll v0, 4(s1)");
0x000018bc addiu at, v0, -1 | at = v0 + -1;
0x000018c0 sc at, 4(s1) | __asm ("sc at, 4(s1)");
0x000018c4 addiu v0, v0, -1 | v0 += -1;
0x000018c8 beqz at, 0x18b8 |
| } while (at == 0);
0x000018cc sync | __asm ("sync");
0x000018d0 lw t9, -0x7f10(gp) | t9 = sym.imp.fflush;
| if (v0 != 0) {
0x000018d4 bnez v0, 0x177c | goto label_0;
| }
0x000018d8 lw t9, -0x7f48(gp) | t9 = sym.imp.json_delete;
0x000018dc move a0, s1 | a0 = s1;
0x000018e0 jalr t9 | t9 ();
0x000018e4 lw gp, 0x10(sp) | gp = *(var_10h);
0x000018e8 b 0x1778 | goto label_1;
| label_5:
0x000018ec lw t9, -0x7f2c(gp) | t9 = sym.imp.json_object;
0x000018f0 jalr t9 | t9 ();
0x000018f4 nop |
0x000018f8 lw gp, 0x10(sp) | gp = *(var_10h);
0x000018fc move a1, v0 | a1 = v0;
0x00001900 move a0, s0 | a0 = s0;
0x00001904 lw t9, -0x7fdc(gp) | t9 = *((gp - 8183));
0x00001908 addiu t9, t9, 0x14d0 | t9 += fcn.000014d0;
0x0000190c move s1, v0 | s1 = v0;
0x00001910 bal 0x14d0 | fcn_000014d0 ();
0x00001914 lw gp, 0x10(sp) | gp = *(var_10h);
| label_9:
0x00001918 lw t9, -0x7f24(gp) | t9 = sym.imp.json_dumps;
| if (s1 == 0) {
0x0000191c beqz s1, 0x1778 | goto label_1;
| }
0x00001920 addiu a1, zero, 0x100 | a1 = 0x100;
0x00001924 move a0, s1 | a0 = s1;
0x00001928 jalr t9 | t9 ();
0x0000192c lw gp, 0x10(sp) | gp = *(var_10h);
0x00001930 move a3, s2 | a3 = s2;
0x00001934 addiu a2, zero, 0x10 | a2 = 0x10;
0x00001938 lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x0000193c lw t9, -0x7f44(gp) | t9 = sym.imp.fwrite;
0x00001940 addiu a1, zero, 1 | a1 = 1;
0x00001944 addiu a0, a0, 0x4588 | a0 += str.Status:_200_OK_r_n;
0x00001948 move s3, v0 | s3 = v0;
0x0000194c jalr t9 | t9 ();
0x00001950 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001954 move a3, s2 | a3 = s2;
0x00001958 addiu a2, zero, 0x22 | a2 = 0x22;
0x0000195c lw a0, -0x7fdc(gp) | a0 = *((gp - 8183));
0x00001960 lw t9, -0x7f44(gp) | t9 = sym.imp.fwrite;
0x00001964 addiu a1, zero, 1 | a1 = 1;
0x00001968 addiu a0, a0, 0x459c | a0 += str.Content_Type:_application_json_r_n_r_n;
0x0000196c jalr t9 | t9 ();
0x00001970 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001974 move a3, s3 | a3 = s3;
0x00001978 addiu a1, zero, 1 | a1 = 1;
0x0000197c lw a2, -0x7fdc(gp) | a2 = *((gp - 8183));
0x00001980 lw t9, -0x7ec8(gp) | t9 = sym.imp.__fprintf_chk
0x00001984 addiu a2, a2, 0x48d8 | a2 += 0x48d8;
0x00001988 move a0, s2 | a0 = s2;
0x0000198c jalr t9 | t9 ();
0x00001990 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001994 lw t9, -0x7f10(gp) | t9 = sym.imp.fflush;
0x00001998 move a0, s2 | a0 = s2;
0x0000199c jalr t9 | t9 ();
0x000019a0 lw gp, 0x10(sp) | gp = *(var_10h);
0x000019a4 lw t9, -0x7efc(gp) | t9 = sym.imp.free;
0x000019a8 move a0, s3 | a0 = s3;
0x000019ac jalr t9 | t9 ();
0x000019b0 lw v1, 4(s1) | v1 = *((s1 + 1));
0x000019b4 addiu v0, zero, -1 | v0 = -1;
0x000019b8 lw gp, 0x10(sp) | gp = *(var_10h);
| if (v1 == v0) {
0x000019bc beq v1, v0, 0x19e4 | goto label_10;
| }
0x000019c0 sync | __asm ("sync");
| do {
0x000019c4 ll v0, 4(s1) | __asm ("ll v0, 4(s1)");
0x000019c8 addiu at, v0, -1 | at = v0 + -1;
0x000019cc sc at, 4(s1) | __asm ("sc at, 4(s1)");
0x000019d0 addiu v0, v0, -1 | v0 += -1;
0x000019d4 beqz at, 0x19c4 |
| } while (at == 0);
0x000019d8 sync | __asm ("sync");
0x000019dc lw t9, -0x7f48(gp) | t9 = sym.imp.json_delete;
| if (v0 != 0) {
0x000019e0 beqz v0, 0x19ec |
| label_10:
0x000019e4 move v0, zero | v0 = 0;
0x000019e8 b 0x178c | goto label_2;
| }
0x000019ec move a0, s1 | a0 = s1;
0x000019f0 jalr t9 | t9 ();
0x000019f4 lw gp, 0x10(sp) | gp = *(var_10h);
0x000019f8 move v0, zero | v0 = 0;
0x000019fc b 0x178c | goto label_2;
| label_7:
0x00001a00 sw v0, 0x1c(sp) | *(var_1ch_3) = v0;
0x00001a04 move a0, s0 | a0 = s0;
0x00001a08 jalr t9 | t9 ();
0x00001a0c lw gp, 0x10(sp) | gp = *(var_10h);
0x00001a10 lw v0, 0x1c(sp) | v0 = *(var_1ch_3);
0x00001a14 b 0x17c0 | goto label_3;
| label_4:
0x00001a18 lw t9, -0x7fb0(gp) | t9 = sym.build_error_message;
0x00001a1c move a3, zero | a3 = 0;
0x00001a20 move a2, zero | a2 = 0;
0x00001a24 addiu a1, zero, 0x7d1 | a1 = 0x7d1;
0x00001a28 move a0, zero | a0 = 0;
0x00001a2c bal 0x1d6c | sym_build_error_message ();
0x00001a30 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001a34 lw t9, -0x7f10(gp) | t9 = sym.imp.fflush;
0x00001a38 move a0, s2 | a0 = s2;
0x00001a3c jalr t9 | t9 ();
0x00001a40 lw gp, 0x10(sp) | gp = *(var_10h);
0x00001a44 addiu v0, zero, -1 | v0 = -1;
0x00001a48 b 0x17c0 | goto label_3;
| label_8:
0x00001a4c lw t9, -0x7f4c(gp) | t9 = sym.imp.__stack_chk_fail;
0x00001a50 jalr t9 | t9 ();
0x00001a54 nop |
0x00001a58 nop |
0x00001a5c nop |
| }
; assembly | /* r2dec pseudo code output */
| /* /logs/firmware/unblob_extracted/firmware_extract/4325012-58052244.squashfs_v4_le_extract/usr/html/axis-cgi/streamprofile.cgi @ 0x4038 */
| #include <stdint.h>
|
; (fcn) sym.param_http_print_error () | void param_http_print_error () {
0x00004038 lui gp, 2 |
0x0000403c addiu gp, gp, -0x7028 |
0x00004040 addu gp, gp, t9 | gp += t9;
0x00004044 addiu sp, sp, -0x30 |
0x00004048 lw t9, -0x7fdc(gp) | t9 = *((gp - 8183));
0x0000404c sw ra, 0x2c(sp) | *(var_2ch) = ra;
0x00004050 sw s2, 0x28(sp) | *(var_28h) = s2;
0x00004054 sw s1, 0x24(sp) | *(var_24h) = s1;
0x00004058 sw s0, 0x20(sp) | *(var_20h) = s0;
0x0000405c sw gp, 0x18(sp) | *(var_18h) = gp;
0x00004060 addiu t9, t9, 0x3f70 | t9 += fcn.00003f70;
0x00004064 lw s0, -0x7f58(gp) | s0 = *((gp - 8150));
0x00004068 move s2, a0 | s2 = a0;
0x0000406c move s1, a1 | s1 = a1;
0x00004070 bal 0x3f70 | fcn_00003f70 ();
0x00004074 lw gp, 0x18(sp) | gp = *(var_18h);
0x00004078 lw a0, (s0) | a0 = *(s0);
0x0000407c sw s2, 0x10(sp) | *(var_10h) = s2;
0x00004080 lw a3, -0x7fdc(gp) | a3 = *((gp - 8183));
0x00004084 lw a2, -0x7fdc(gp) | a2 = *((gp - 8183));
0x00004088 lw t9, -0x7ec8(gp) | t9 = sym.imp.__fprintf_chk
0x0000408c addiu a3, a3, 0x493c | a3 += str.Status;
0x00004090 addiu a2, a2, 0x4944 | a2 += str._s:__d_r_n;
0x00004094 addiu a1, zero, 1 | a1 = 1;
0x00004098 jalr t9 | t9 ();
0x0000409c lw gp, 0x18(sp) | gp = *(var_18h);
0x000040a0 lw a0, (s0) | a0 = *(s0);
0x000040a4 addiu a1, zero, 1 | a1 = 1;
0x000040a8 lw v0, -0x7fdc(gp) | v0 = *((gp - 8183));
0x000040ac lw a3, -0x7fdc(gp) | a3 = *((gp - 8183));
0x000040b0 lw a2, -0x7fdc(gp) | a2 = *((gp - 8183));
0x000040b4 lw t9, -0x7ec8(gp) | t9 = sym.imp.__fprintf_chk
0x000040b8 addiu v0, v0, 0x496c | v0 += str.text_plain;
0x000040bc addiu a3, a3, 0x4950 | a3 += str.Content_type;
0x000040c0 addiu a2, a2, 0x4960 | a2 += str._s:__s_r_n_r_n;
0x000040c4 sw v0, 0x10(sp) | *(var_10h) = v0;
0x000040c8 jalr t9 | t9 ();
0x000040cc lw gp, 0x18(sp) | gp = *(var_18h);
0x000040d0 lw a0, (s0) | a0 = *(s0);
0x000040d4 move a3, s1 | a3 = s1;
0x000040d8 lw a2, -0x7fdc(gp) | a2 = *((gp - 8183));
0x000040dc lw t9, -0x7ec8(gp) | t9 = sym.imp.__fprintf_chk
0x000040e0 addiu a2, a2, 0x4978 | a2 += 0x4978;
0x000040e4 addiu a1, zero, 1 | a1 = 1;
0x000040e8 jalr t9 | t9 ();
0x000040ec lw gp, 0x18(sp) | gp = *(var_18h);
0x000040f0 lw a0, (s0) | a0 = *(s0);
0x000040f4 lw ra, 0x2c(sp) | ra = *(var_2ch);
0x000040f8 lw s2, 0x28(sp) | s2 = *(var_28h);
0x000040fc lw s1, 0x24(sp) | s1 = *(var_24h);
0x00004100 lw s0, 0x20(sp) | s0 = *(var_20h);
0x00004104 lw t9, -0x7f10(gp) | t9 = sym.imp.fflush;
0x00004108 addiu sp, sp, 0x30 |
0x0000410c jr t9 | return t9 ();
| }
[*] Function fprintf used 8 times streamprofile.cgi
