[*] Binary protection state of dcore
Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function fprintf tear down of dcore
subs r6, r6, r4
beq 0x134a
movs r4, 0
movs r1, 0
mov r0, r5
adds r4, 1
bl 0x1b18
cmp r6, r4
bne 0x133c
ldr r2, [0x00001374]
ldr r3, [0x0000136c]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0xc]
eors r2, r3
mov.w r3, 0
bne 0x1362
add sp, 0x14
pop {r4, r5, r6, r7, pc}
blx sym.imp.__fprintf_chk
nop
subs r3, 0xe4
--
mov r2, r5
movs r1, 6
mov r0, r7
bl 0x12d8
ldr r2, [0x00001414]
ldr r3, [0x00001408]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0x204]
eors r2, r3
mov.w r3, 0
bne 0x1400
add.w sp, sp, 0x20c
pop {r4, r5, r6, r7, pc}
ldr r0, [r5]
blx 0xea0
ldr r0, [r5]
blx sym.imp.read
b 0x13d8
blx sym.imp.__fprintf_chk
subs r3, 0x42
movs r0, r0
--
add sp, 0x1b4
pop.w {r4, r5, r6, r7, r8, sb, sl, fp, pc}
add r4, sp, 4
mov r1, r5
mov r3, r4
movs r2, 0
movw r0, 0x4202
blx 0xe3c
mov r2, r4
mov r4, sp
mov r1, sl
mov r3, r4
mov r0, r5
bl 0x2930
ldr r3, [r4]
mov r2, r0
movs r1, 1
mov r0, sb
bl 0x12d8
b 0x1478
blx sym.imp.__fprintf_chk
nop
subs r2, 0xaa
--
ldr r0, [sp, 0x38]
blx sym.imp.read
movs r0, 0
b 0x17e2
mov r1, fp
mov fp, r4
ldr.w r2, [r8]
mov r0, fp
ldr r4, [sp, 0x10]
b 0x19ce
mov r0, fp
b 0x18b6
mov r2, r7
mov r0, fp
b 0x19ce
blx 0xea0
ldr r0, [sp, 0x3c]
add r4, sp, 0x38
blx sym.imp.read
b 0x16b6
blx sym.imp.__fprintf_chk
push {r4, lr}
cbz r0, 0x1a78
--
add sp, 8
pop {r4, r5, r6, pc}
movs r1, 0x13
mov r0, r4
blx sym.imp.elf_begin
b 0x1b6e
mov r3, r5
movs r2, 0
mov r1, r4
movs r0, 0x11
blx 0xe3c
b 0x1b9e
movs r3, 0
mov r1, r4
mov r2, r3
movs r0, 7
blx 0xe3c
cmp r0, 0
bge 0x1b86
b 0x1b9e
blx sym.imp.__fprintf_chk
adds r3, 0x74
movs r0, r0
--
bl 0x1f5c
b 0x232c
strd r3, r3, [sp, 0x30]
str r3, [sp, 0x28]
str r3, [sp, 0x18]
b 0x20cc
mov.w r0, -1
blx sym.imp.getopt
ldr r1, [0x00002410]
mov r2, r0
movs r0, 1
add r1, pc
blx 0xe54
b 0x2262
mov.w r3, -1
str r3, [sp, 0x2c]
blx 0xea0
mov r0, r6
bl 0x1f5c
b 0x232c
blx sym.imp.__fprintf_chk
nop
cmp r6, 0xf8
--
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0xac]
eors r2, r3
mov.w r3, 0
bne 0x2586
ldr.w r0, [sl, 0x20]
add sp, 0xb4
pop.w {r4, r5, r6, r7, r8, sb, sl, fp, lr}
b.w 0xe9c
mov.w r0, -1
blx sym.imp.getopt
ldr r1, [0x000025a0]
mov r2, r0
movs r0, 1
add r1, pc
blx 0xe54
cmp r6, 0
bne 0x250e
b 0x2514
blx sym.imp.__fprintf_chk
nop
cmp r2, 0xac
--
ldr r3, [r7, 0xc]
str.w r0, [r3, r5, lsl 2]
mov r0, r8
blx sym.imp.strcmp
adds r5, 1
mov r4, r0
cmp r0, 0
bne 0x262e
str r6, [r7, 0x10]
ldr r2, [0x000026a0]
ldr r3, [0x00002694]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 4]
eors r2, r3
mov.w r3, 0
bne 0x2670
add sp, 8
pop.w {r4, r5, r6, r7, r8, pc}
blx sym.imp.__fprintf_chk
mov r0, r8
blx sym.imp.elf_version
--
ldr r3, [0x00002734]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0xc]
eors r2, r3
mov.w r3, 0
bne 0x272c
add sp, 0x14
pop {r4, r5, r6, r7, pc}
ldr r1, [0x00002740]
mov r3, r6
ldr r2, [0x00002744]
ldr.w r1, [ip, r1]
add r2, pc
ldr r0, [r1]
movs r1, 1
blx sym.imp.fputc
mov r0, r4
b 0x26fc
blx sym.imp.__fprintf_chk
cmp r0, 0x12
movs r0, r0
--
ldr r2, [r3]
ldr r3, [sp, 0x34]
eors r2, r3
mov.w r3, 0
bne 0x28ee
mov r0, sb
add sp, 0x3c
pop.w {r4, r5, r6, r7, r8, sb, sl, fp, pc}
ldr r3, [sp, 0x28]
add.w sb, sb, 1
subs r3, 1
cmp r4, r3
str r3, [sp, 0x28]
blt 0x2844
mov.w sb, 0
str r3, [r5, 0x10]
b 0x28b4
ldr r3, [0x0000291c]
ldr.w r4, [sl, r3]
b 0x28a6
blx sym.imp.__fprintf_chk
nop
movs r7, 0x72
[*] Function fprintf used 10 times dcore
