[*] Binary protection state of php-cgi
Full RELRO No Canary found NX enabled No PIE No RPATH No RUNPATH No Symbols
[*] Function popen tear down of php-cgi
4cb1b4: 279c70f0 addiu gp,gp,28912
4cb1b8: 0399e021 addu gp,gp,t9
4cb1bc: 27bdffe0 addiu sp,sp,-32
4cb1c0: 8f99a104 lw t9,-24316(gp)
4cb1c4: afbc0010 sw gp,16(sp)
4cb1c8: afbf001c sw ra,28(sp)
4cb1cc: 0320f809 jalr t9
4cb1d0: 00002025 move a0,zero
4cb1d4: 8fbc0010 lw gp,16(sp)
4cb1d8: 2404ffff li a0,-1
4cb1dc: 10440006 beq v0,a0,4cb1f8 <zif_dl@@Base+0x84c>
4cb1e0: 8f8386c4 lw v1,-31036(gp)
4cb1e4: 8fbf001c lw ra,28(sp)
4cb1e8: ac62eba0 sw v0,-5216(v1)
4cb1ec: 00001025 move v0,zero
4cb1f0: 03e00008 jr ra
4cb1f4: 27bd0020 addiu sp,sp,32
4cb1f8: 1000fffa b 4cb1e4 <zif_dl@@Base+0x838>
4cb1fc: 24021000 li v0,4096
004cb200 <php_exec@@Base>:
4cb200: 3c1c0023 lui gp,0x23
4cb204: 279c70a0 addiu gp,gp,28832
4cb208: 0399e021 addu gp,gp,t9
4cb20c: 27bdffb0 addiu sp,sp,-80
4cb210: 8f999fd8 lw t9,popen
4cb214: afb00028 sw s0,40(sp)
4cb218: 00a08025 move s0,a1
--
4cc24c: afbc0010 sw gp,16(sp)
4cc250: afbf002c sw ra,44(sp)
4cc254: afb20028 sw s2,40(sp)
4cc258: afb00020 sw s0,32(sp)
4cc25c: 10a2000d beq a1,v0,4cc294 <php_escape_shell_arg@@Base+0x5e0>
4cc260: 24020006 li v0,6
4cc264: 8f9980bc lw t9,-32580(gp)
4cc268: 24070001 li a3,1
4cc26c: 24060001 li a2,1
4cc270: 00002025 move a0,zero
4cc274: 0320f809 jalr t9
4cc278: 00000000 nop
4cc27c: 8fbf002c lw ra,44(sp)
4cc280: 8fb20028 lw s2,40(sp)
4cc284: 8fb10024 lw s1,36(sp)
4cc288: 8fb00020 lw s0,32(sp)
4cc28c: 03e00008 jr ra
4cc290: 27bd0030 addiu sp,sp,48
4cc294: 90830038 lbu v1,56(a0)
4cc298: 14620016 bne v1,v0,4cc2f4 <php_escape_shell_arg@@Base+0x640>
4cc29c: 8f9980c8 lw t9,-32568(gp)
4cc2a0: 8c820030 lw v0,48(a0)
4cc2a4: afa20018 sw v0,24(sp)
4cc2a8: 8fb00018 lw s0,24(sp)
4cc2ac: 8f858108 lw a1,-32504(gp)
4cc2b0: 8f999fd8 lw t9,popen
4cc2b4: 26100010 addiu s0,s0,16
4cc2b8: 24a5185c addiu a1,a1,6236
--
4ce900: 8ea3000c lw v1,12(s5)
4ce904: 14430044 bne v0,v1,4cea18 <zif_fclose@@Base+0x2e0>
4ce908: 8fbc0018 lw gp,24(sp)
4ce90c: 92030048 lbu v1,72(s0)
4ce910: 24020006 li v0,6
4ce914: 14620047 bne v1,v0,4cea34 <zif_fclose@@Base+0x2fc>
4ce918: 26110040 addiu s1,s0,64
4ce91c: 8e020040 lw v0,64(s0)
4ce920: afa20020 sw v0,32(sp)
4ce924: 8fa20020 lw v0,32(sp)
4ce928: 8f99817c lw t9,-32388(gp)
4ce92c: 24510010 addiu s1,v0,16
4ce930: 8c52000c lw s2,12(v0)
4ce934: 02202025 move a0,s1
4ce938: 0320f809 jalr t9
4ce93c: 02402825 move a1,s2
4ce940: 8fbc0018 lw gp,24(sp)
4ce944: 02403025 move a2,s2
4ce948: 24050062 li a1,98
4ce94c: 8f999d00 lw t9,-25344(gp)
4ce950: 00402025 move a0,v0
4ce954: 0320f809 jalr t9
4ce958: 00408025 move s0,v0
4ce95c: 1440003d bnez v0,4cea54 <zif_fclose@@Base+0x31c>
4ce960: 8fbc0018 lw gp,24(sp)
4ce964: 8f999fd8 lw t9,popen
4ce968: 02002825 move a1,s0
4ce96c: 0320f809 jalr t9
--
4e45c8: 8f99810c lw t9,-32500(gp)
4e45cc: 24c68500 addiu a2,a2,-31488
4e45d0: 24050002 li a1,2
4e45d4: 0320f809 jalr t9
4e45d8: 00002025 move a0,zero
4e45dc: 8fbc0020 lw gp,32(sp)
4e45e0: 1000ff8c b 4e4414 <php_mail@@Base+0x294>
4e45e4: 8fa40034 lw a0,52(sp)
4e45e8: 1240002d beqz s2,4e46a0 <php_mail@@Base+0x520>
4e45ec: 8f86803c lw a2,-32708(gp)
4e45f0: 8f9985f0 lw t9,-31248(gp)
4e45f4: afb20010 sw s2,16(sp)
4e45f8: 02203825 move a3,s1
4e45fc: 24c68ebc addiu a2,a2,-28996
4e4600: 00002825 move a1,zero
4e4604: 0320f809 jalr t9
4e4608: 27a40038 addiu a0,sp,56
4e460c: 8fbc0020 lw gp,32(sp)
4e4610: 8f99a164 lw t9,-24220(gp)
4e4614: 0320f809 jalr t9
4e4618: 00000000 nop
4e461c: 8fbc0020 lw gp,32(sp)
4e4620: 8fa40038 lw a0,56(sp)
4e4624: ac400000 sw zero,0(v0)
4e4628: 8f85803c lw a1,-32708(gp)
4e462c: 8f999fd8 lw t9,popen
4e4630: 24a5b974 addiu a1,a1,-18060
4e4634: 0320f809 jalr t9
--
5cc530: 24020063 li v0,99
5cc534: a2020000 sb v0,0(s0)
5cc538: 8ec30004 lw v1,4(s6)
5cc53c: 24020064 li v0,100
5cc540: a2020001 sb v0,1(s0)
5cc544: 24020020 li v0,32
5cc548: a2020002 sb v0,2(s0)
5cc54c: 8fbc0010 lw gp,16(sp)
5cc550: 14600029 bnez v1,5cc5f8 <virtual_popen@@Base+0x150>
5cc554: 26020004 addiu v0,s0,4
5cc558: 00402025 move a0,v0
5cc55c: 2402002f li v0,47
5cc560: a2020003 sb v0,3(s0)
5cc564: 2403003b li v1,59
5cc568: 8f999eb8 lw t9,-24904(gp)
5cc56c: 24020020 li v0,32
5cc570: a0830001 sb v1,1(a0)
5cc574: 26460001 addiu a2,s2,1
5cc578: a0820000 sb v0,0(a0)
5cc57c: a0820002 sb v0,2(a0)
5cc580: 02a02825 move a1,s5
5cc584: 0320f809 jalr t9
5cc588: 24840003 addiu a0,a0,3
5cc58c: 8fbc0010 lw gp,16(sp)
5cc590: 02802825 move a1,s4
5cc594: 8f999fd8 lw t9,popen
5cc598: 0320f809 jalr t9
5cc59c: 02002025 move a0,s0
[*] Function popen used 5 times php-cgi
