[*] Binary protection state of agetty
Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function sprintf tear down of agetty
cmp r2, r6
mov r0, r4
it hs
movhs r2, r6
blx 0x1b24
mov r0, r4
pop {r4, r5, r6, pc}
nop
ldr r2, [0x000041a0]
ldr r3, [0x000041a4]
push {r4, r5, r6, lr}
movs r4, 0
add r2, pc
sub sp, 8
mov r6, r0
ldr r3, [r2, r3]
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
str r4, [sp]
blx sym.imp.__vasprintf_chk
movs r2, 0xa
mov r5, r0
--
mov r0, r6
blx 0x1b24
movs r3, 0
strb r3, [r6, r5]
pop.w {r3, r4, r5, r6, r7, r8, sb, pc}
ldr r2, [0x00004588]
ldr r3, [0x0000458c]
push {r4, r5, r6, r7, lr}
add r2, pc
vpush {d8}
sub sp, 0x14
ldr r3, [r2, r3]
ldr r3, [r3]
str r3, [sp, 0xc]
mov.w r3, 0
cbz r1, 0x451c
mov r6, r0
mov r4, r1
movs r7, 0
vldr d8, [0x00004584]
blx sym.imp.__vasprintf_chk
mov r5, r0
mov r2, r4
--
mov.w r8, 0
mov sl, r8
ldr r0, [sp, 0xc]
mov r2, r6
mov r1, r5
blx sym.imp.read
cmp r0, 0
blt 0x48cc
beq 0x4942
subs r6, r6, r0
add r5, r0
add r8, r0
beq 0x4942
ldr r0, [sp, 0xc]
mov r2, r6
mov r1, r5
mov.w sl, 0
blx sym.imp.read
cmp r0, 0
bge 0x48b0
blx sym.imp.__vasprintf_chk
ldr r3, [r0]
cmp r3, 4
--
mov r1, sb
strd r5, r6, [r4, -0xb4]
str r8, [r4, -0xa0]
strd r3, r7, [r4, -0x9c]
strd fp, fp, [r4, -0x90]
str fp, [r4, -0x88]
str sl, [r4, -0x94]
blx 0x1f7c
cmp r0, 0
blt 0x50e8
cmp r0, 0xf
ble 0x50e2
ldr r2, [r4, -0x4]
cmp r0, r2
it hs
cmphs r2, 0xf
bhi 0x5132
ldr r3, [sp, 0xc]
ldr r0, [r3, 4]
b 0x50a8
blx sym.imp.__vasprintf_chk
ldr r3, [r0]
cmp r3, 0xb
--
ldr r0, [r4, 0xc]
blx 0x1af0
ldr r2, [r4, 4]
movs r3, 0
strd r3, r3, [r4, 4]
ldr r3, [0x000056d4]
str r2, [r4, 0xc]
ldr r2, [0x000056d8]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0xc]
eors r2, r3
mov.w r3, 0
bne 0x56c0
add sp, 0x14
vpop {d8}
pop.w {r4, r5, r6, r7, r8, sb, sl, fp, pc}
ldr.w sb, [0x000056dc]
mov.w fp, 2
blx sym.imp.__vasprintf_chk
vldr d8, [0x000056cc]
mov r5, r0
--
bne 0x5588
cmp r3, 0xb
bne 0x55ec
movs r1, 0
mov r0, sp
vstr d8, [sp]
blx 0x1afc
b 0x55ec
cmp r3, 0xb
add sb, r0
bne 0x55ec
b 0x5626
mov r2, r7
movs r1, 1
str.w r8, [r7, 4]
movs r0, 0
blx sym.imp.__vsyslog_chk
b 0x55aa
ldr r6, [r4, 4]
mov.w sb, 0
blx sym.imp.__vasprintf_chk
vldr d8, [0x000056cc]
mov r5, r0
--
bl 0x4fa0
cmp r0, 0
bne 0x57ca
mov r2, sb
mov r1, r6
mov r0, r7
bl 0x52ec
ldr r4, [r7, 0xc]
cbz r4, 0x5750
ldr r1, [r7, 4]
cbz r1, 0x5750
mov r0, r4
blx sym.imp.strcmp
mov r5, r0
cbz r0, 0x57be
ldr r3, [r6]
lsls r3, r3, 0x13
bpl 0x5716
ldr r5, [0x000059d8]
mov.w fp, 9
blx sym.imp.__vasprintf_chk
mov r4, r0
add r5, pc
--
lsls r3, r3, 0xd
bmi 0x5878
bl 0x42fc
mov r7, r0
cmp r0, 0
beq 0x5874
movs r1, 0x2e
add.w r8, sp, 0xc
blx sym.imp.setenv
ldr r3, [r6]
movs r2, 0
str.w r2, [r8]
ands r3, r3, 0x80000
bne 0x58e0
cbz r0, 0x580c
strb r3, [r0]
mov sb, r7
mov r0, sb
blx sym.imp.strchr
mov r5, r0
blx sym.imp.__vasprintf_chk
mov r4, r0
cmp r5, 0
--
ldr r3, [r6, 8]
cbz r3, 0x58a0
ldr r2, [0x000059e0]
ldr r3, [0x000059d0]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0x134]
eors r2, r3
mov.w r3, 0
bne.w 0x5aac
add sp, 0x13c
vpop {d8}
pop.w {r4, r5, r6, r7, r8, sb, sl, fp, pc}
lsls r4, r3, 0x13
bmi 0x5858
lsls r2, r3, 0xd
bpl 0x57e6
ldr r6, [0x000059e4]
movs r4, 7
blx sym.imp.__vasprintf_chk
movs r7, 0
mov r5, r0
--
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0x7c]
eors r2, r3
mov.w r3, 0
bne 0x5b8c
mov r0, r5
add sp, 0x80
pop {r4, r5, r6, pc}
ldr r0, [0x00005ba0]
add r0, pc
blx sym.imp.nice
b 0x5b3a
ldr r0, [0x00005ba4]
add r0, pc
blx sym.imp.nice
mov r0, r5
blx 0x2018
mov.w r5, -1
b 0x5b3a
blx sym.imp.__vasprintf_chk
ldr r3, [r0]
cmp r3, 0x6f
--
bx lr
bl 0x5ad8
subs r4, r0, 0
bge 0x5ca4
movs r3, 0
strb.w r3, [sp, 0x124]
movs r2, 0
mov r1, r6
movs r0, 0xd
blx sym.imp.fwrite
ldrb.w r0, [sp, 0x124]
sub.w r0, r0, 6
clz r0, r0
lsrs r0, r0, 5
b 0x5c06
bl 0x5ad8
subs r4, r0, 0
blt 0x5c32
strb.w r5, [sp, 0x128]
mov.w sl, 2
blx sym.imp.__vasprintf_chk
vldr d8, [0x00005ddc]
mov r8, r0
--
mov r2, sl
mov r1, sb
mov r0, r4
str.w r7, [r8]
blx sym.imp.fileno
cmp r0, 0
ldr.w r3, [r8]
ble.w 0x5d8e
subs.w sl, sl, r0
beq 0x5cec
cmp r3, 0xb
add sb, r0
bne 0x5c72
movs r1, 0
mov r0, r5
vstr d8, [sp]
blx 0x1afc
b 0x5c72
strb.w r5, [sp, 0x128]
mov.w sl, 2
blx sym.imp.__vasprintf_chk
vldr d8, [0x00005ddc]
mov r8, r0
--
cmp r0, 0
ldr.w r3, [r8]
ble 0x5d74
subs.w sl, sl, r0
beq 0x5cec
cmp r3, 0xb
add sb, r0
bne 0x5cbc
movs r1, 0
mov r0, r5
vstr d8, [sp]
blx 0x1afc
b 0x5cbc
cmp r3, 0xb
beq 0x5daa
movs r2, 0
movs r3, 3
strb.w r2, [sp, 0x124]
strd r4, r3, [r5]
b 0x5d08
blx sym.imp.__vasprintf_chk
ldr r3, [r0]
cmp r3, 4
--
mov sb, r3
add.w r8, sp, 0x124
strh.w r3, [sp, 0x124]
mov r2, r7
mov r1, r8
mov r0, r4
blx sym.imp.read
cmp r0, 0
blt 0x5d58
beq 0x5d6c
subs r7, r7, r0
add r8, r0
beq 0x5d6c
mov r2, r7
mov r1, r8
mov r0, r4
mov.w sb, 0
blx sym.imp.read
cmp r0, 0
bge 0x5d3e
blx sym.imp.__vasprintf_chk
ldr r3, [r0]
cmp r3, 4
--
ldr r3, [0x00005e94]
add r3, pc
str r0, [r3]
bx lr
strh r2, [r2, r7]
movs r0, r0
push.w {r4, r5, r6, r7, r8, sb, sl, fp, lr}
sub sp, 0x34
str r2, [sp, 8]
mov r6, r0
ldr.w r2, [0x00006390]
vmov.i32 d16, 0
ldr.w r3, [0x00006394]
add r2, pc
str r1, [sp, 4]
vstr d16, [r1]
ldr r3, [r2, r3]
ldr r3, [r3]
str r3, [sp, 0x2c]
mov.w r3, 0
blx sym.imp.__vasprintf_chk
str r0, [sp]
cmp r6, 0
--
mov r0, r3
adds r3, 1
cmp r2, 0
bne 0x64ec
movs r0, 0
bx lr
push.w {r4, r5, r6, r7, r8, lr}
movs r7, 0
ldr r4, [0x0000657c]
sub sp, 8
mov r8, r1
mov r6, r2
ldr r3, [0x00006580]
add r4, pc
ldr r3, [r4, r3]
mov r4, r0
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
str r7, [sp]
blx sym.imp.__vasprintf_chk
str r7, [r0]
cbz r4, 0x6572
--
ldr r0, [0x000067e0]
movs r0, r0
lsls r0, r4, 8
movs r0, r0
ldr r0, [0x000066c8]
movs r0, r0
push.w {r4, r5, r6, r7, r8, sb, lr}
mov.w sb, 0
ldr r4, [0x00006628]
sub sp, 0xc
mov r8, r1
mov r7, r2
ldr r3, [0x0000662c]
add r4, pc
ldr r3, [r4, r3]
mov r4, r0
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
str.w sb, [sp]
blx sym.imp.__vasprintf_chk
str.w sb, [r0]
cbz r4, 0x65d4
--
ldrd r2, r3, [sp]
mov.w ip, -1
adds.w r1, r2, -0x80000000
adc r3, r3, 0
cmp ip, r1
sbcs.w r3, r0, r3
it hs
strhs r2, [r4]
blo 0x668a
ldr r2, [0x000066a8]
ldr r3, [0x000066a4]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0xc]
eors r2, r3
mov.w r3, 0
bne 0x669a
add sp, 0x10
pop {r4, pc}
blx sym.imp.__vasprintf_chk
movs r2, 0x22
mov r3, r0
--
bl 0x6588
cbnz r0, 0x66e2
ldrd r2, r3, [sp]
mov.w r1, -1
cmp r1, r2
sbcs.w r3, r0, r3
it hs
strhs r2, [r4]
blo 0x66fa
ldr r2, [0x00006718]
ldr r3, [0x00006714]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0xc]
eors r2, r3
mov.w r3, 0
bne 0x670a
add sp, 0x10
pop {r4, pc}
blx sym.imp.__vasprintf_chk
movs r2, 0x22
mov r3, r0
--
push.w {r4, r5, r6, r7, r8, sb, lr}
mov r5, r2
mov r2, r1
ldr r1, [0x000067c8]
sub sp, 0x14
mov r6, r0
ldr r3, [0x000067cc]
add r1, pc
vmov.i32 d16, 0
ldr r7, [sp, 0x30]
ldr r3, [r1, r3]
mov r1, sp
ldrd r4, sb, [sp, 0x34]
ldr.w r8, [sp, 0x3c]
ldr r3, [r3]
str r3, [sp, 0xc]
mov.w r3, 0
vstr d16, [sp]
bl 0x6504
cbz r0, 0x676e
blx sym.imp.__vasprintf_chk
ldr r3, [r0]
ldr r1, [0x000067d0]
cmp r3, 0x22
add r1, pc
ldr r0, [r1]
beq 0x678e
ldr r1, [0x000067d4]
mov r3, r6
mov r2, r5
add r1, pc
blx 0x1ef8
orrs.w r3, r7, r4
ldrd r0, r1, [sp]
beq 0x679a
cmp r0, r7
sbcs.w r4, r1, r4
bge 0x679a
blx sym.imp.__vasprintf_chk
ldr r3, [0x000067d8]
movs r2, 0x22
--
ldrd r7, r6, [sp, 0x28]
vmov.i32 d16, 0
ldr r3, [r1, r3]
mov r1, sp
ldr r3, [r3]
str r3, [sp, 0xc]
mov.w r3, 0
vstr d16, [sp]
bl 0x6588
orr.w ip, r7, r6
clz r1, r0
lsrs r1, r1, 5
cmp.w ip, 0
it eq
moveq r1, 0
cbz r1, 0x6848
ldrd r0, r1, [sp]
cmp r7, r0
sbcs r6, r1
bhs 0x684e
blx sym.imp.__vasprintf_chk
ldr r3, [0x00006890]
movs r2, 0x22
--
add r3, pc
ldr r0, [r3]
ldr r1, [0x00006894]
mov r3, r5
mov r2, r4
add r1, pc
blx sym.imp.iswprint
cbnz r0, 0x6866
ldrd r0, r1, [sp]
ldr r2, [0x00006898]
ldr r3, [0x0000688c]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0xc]
eors r2, r3
mov.w r3, 0
bne 0x6882
add sp, 0x14
pop {r4, r5, r6, r7, pc}
blx sym.imp.__vasprintf_chk
ldr r2, [r0]
ldr r3, [0x0000689c]
--
movs r0, r0
cmp r2, fp
movs r0, r0
ldr r1, [0x00006c60]
movs r0, r0
cmp r4, 0x58
movs r0, r0
ldr r2, [0x00006930]
ldr r3, [0x00006934]
push {r4, r5, r6, r7, lr}
mov r4, r0
add r2, pc
sub sp, 0xc
movs r6, 0
mov r7, r1
ldr r3, [r2, r3]
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
str r6, [sp]
blx sym.imp.__vasprintf_chk
str r6, [r0]
cbz r4, 0x68ce
--
movs r0, r0
add sl, r5
movs r0, r0
ldr r1, [0x00006a60]
movs r0, r0
cmp r3, 0xae
movs r0, r0
ldr r2, [0x000069d8]
ldr r3, [0x000069dc]
push {r4, r5, r6, r7, lr}
mov r4, r0
add r2, pc
sub sp, 0xc
movs r6, 0
mov r7, r1
ldr r3, [r2, r3]
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
str r6, [sp]
blx sym.imp.__vasprintf_chk
str r6, [r0]
cbz r4, 0x6976
--
movs r0, r0
add r2, r0
movs r0, r0
ldr r0, [0x00006c68]
movs r0, r0
cmp r3, 6
movs r0, r0
ldr r2, [0x00006a84]
ldr r3, [0x00006a88]
push {r4, r5, r6, r7, lr}
mov r4, r0
add r2, pc
sub sp, 0xc
movs r6, 0
mov r7, r1
ldr r3, [r2, r3]
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
str r6, [sp]
blx sym.imp.__vasprintf_chk
str r6, [r0]
cbz r4, 0x6a1e
--
cmp r2, 0xaa
movs r0, r0
muls r0, r3, r0
movs r0, r0
invalid
cmp r2, 0x5c
movs r0, r0
ldr r2, [0x00006b30]
ldr r3, [0x00006b34]
push {r4, r5, r6, r7, lr}
mov r4, r0
add r2, pc
sub sp, 0xc
movs r6, 0
mov r7, r1
ldr r3, [r2, r3]
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
str r6, [sp]
blx sym.imp.__vasprintf_chk
str r6, [r0]
cbz r4, 0x6aca
--
cmp r4, r5
movs r0, r0
bx sb
movs r0, r0
cmp r1, 0xb0
movs r0, r0
ldr r2, [0x00006bb4]
ldr r3, [0x00006bb8]
push {r4, r5, lr}
sub sp, 0x14
add r2, pc
mov r4, r1
mov r1, sp
mov r5, r0
ldr r3, [r2, r3]
ldr r3, [r3]
str r3, [sp, 0xc]
mov.w r3, 0
bl 0x63a4
cbz r0, 0x6b92
blx sym.imp.__vasprintf_chk
ldr r2, [0x00006bbc]
ldr r3, [r0]
--
pop {r3, r4, r5, r6, r7, pc}
nop
push.w {r4, r5, r6, r7, r8, sb, lr}
mov r5, r2
ldr r2, [0x000073cc]
mov r6, r3
sub sp, 0xc
mov.w sb, 0
ldr r3, [0x000073d0]
add r2, pc
ldr r3, [r2, r3]
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
str.w sb, [sp]
cbz r0, 0x7360
mov r4, r0
str r6, [r1]
str r6, [r5]
mov r8, r1
blx sym.imp.__vasprintf_chk
str.w sb, [r0]
mov r7, r0
--
ldrb.w r2, [r3, r6, lsl 2]
rsbs r0, r2, 0
b 0x7830
rsbs r0, r3, 0
b 0x7830
nop
ldr r2, [0x000078ec]
ldr r3, [0x000078f0]
push {r4, r5, r6, lr}
sub sp, 8
add r2, pc
ldr r3, [r2, r3]
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
blx sym.imp.getttynam
cbz r0, 0x78e0
mov r4, r0
movs r6, 0
str r6, [sp]
blx sym.imp.__vasprintf_chk
movs r2, 0xa
mov r5, r0
[*] Function sprintf used 30 times agetty
