[+] Check binaries for critical functions
This module identifies the usage of critical binary functions in firmware via readelf.
Examples of binary functions are system, strcpy, printf and strcat. These functions are listed in the configuration
file config/functions.cfg.
[*] Interesting functions: fprintf mmap popen printf sprintf strcat strcpy system
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/lib/libmove_inf.so (-rw-r--r-- root root) found:
31: 0000d340 0 FUNC GLOBAL DEFAULT UND printf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/lib/libt20.so (-rw-r--r-- root root) found:
444: 00060c60 0 FUNC GLOBAL DEFAULT UND printf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/lib/libIOTCAPIs.so (-rw-r--r-- root root) found:
265: 00039d20 0 FUNC GLOBAL DEFAULT UND sprintf
396: 00039b50 0 FUNC GLOBAL DEFAULT UND fprintf
546: 00039960 0 FUNC GLOBAL DEFAULT UND printf
555: 00039940 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/lib/libsCHL.so (-rw-r--r-- root root) found:
93: 00004800 0 FUNC GLOBAL DEFAULT UND printf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/lib/libmp.so (-rw-r--r-- root root) found:
558: 000a6860 0 FUNC GLOBAL DEFAULT UND sprintf
766: 000a6620 0 FUNC GLOBAL DEFAULT UND strcat
773: 000a6610 0 FUNC GLOBAL DEFAULT UND fprintf
832: 000a6580 0 FUNC GLOBAL DEFAULT UND mmap
1030: 000a63a0 0 FUNC GLOBAL DEFAULT UND printf
1060: 000a6340 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/lib/libaudioProcess.so (-rw-r--r-- root root) found:
407: 0006ad00 0 FUNC GLOBAL DEFAULT UND strcpy
479: 0006ac60 0 FUNC GLOBAL DEFAULT UND printf
664: 0006aa30 0 FUNC GLOBAL DEFAULT UND sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/lib/liblogserver.so (-rw-r--r-- root root) found:
39: 000049d0 0 FUNC GLOBAL DEFAULT UND sprintf
76: 00004830 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/lib/libsysutils.so (-rw-r--r-- root root) found:
52: 00005ca0 0 FUNC GLOBAL DEFAULT UND sprintf
75: 00005bb0 0 FUNC GLOBAL DEFAULT UND strcat
81: 00005b60 0 FUNC GLOBAL DEFAULT UND mmap
90: 00005ae0 0 FUNC GLOBAL DEFAULT UND printf
93: 00005ab0 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/readFile (-rw-r--r-- root root) found:
1: 00000000 0 FUNC GLOBAL DEFAULT UND printf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/hl_client (-rw-r--r-- root root) found:
4: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy
5: 00000000 0 FUNC GLOBAL DEFAULT UND printf
77: 00000000 0 FUNC GLOBAL DEFAULT UND sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/wpa_supplicant (-rw-r--r-- root root) found:
1: 00000000 0 FUNC GLOBAL DEFAULT UND printf
98: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/iwlist (-rw-r--r-- root root) found:
4: 00000000 0 FUNC GLOBAL DEFAULT UND printf
18: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
56: 00408160 0 FUNC GLOBAL DEFAULT UND sprintf
75: 00408040 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/iwpriv (-rw-r--r-- root root) found:
4: 00000000 0 FUNC GLOBAL DEFAULT UND printf
15: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
50: 00405c90 0 FUNC GLOBAL DEFAULT UND sprintf
71: 00405b50 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/iCamera (-rw-r--r-- root root) found:
25: 00000000 0 FUNC GLOBAL DEFAULT UND printf
59: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
175: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy
249: 00000000 0 FUNC GLOBAL DEFAULT UND popen
311: 00000000 0 FUNC GLOBAL DEFAULT UND sprintf
374: 00000000 0 FUNC GLOBAL DEFAULT UND system
381: 00000000 0 FUNC GLOBAL DEFAULT UND strcat
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/singleBoadTest (-rw-r--r-- root root) found:
39: 00000000 0 FUNC GLOBAL DEFAULT UND strcat
43: 00000000 0 FUNC GLOBAL DEFAULT UND system
45: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy
75: 00000000 0 FUNC GLOBAL DEFAULT UND popen
76: 00000000 0 FUNC GLOBAL DEFAULT UND printf
156: 00000000 0 FUNC GLOBAL DEFAULT UND sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/iwgetid (-rw-r--r-- root root) found:
3: 00000000 0 FUNC GLOBAL DEFAULT UND printf
50: 00405850 0 FUNC GLOBAL DEFAULT UND sprintf
64: 00405770 0 FUNC GLOBAL DEFAULT UND fprintf
75: 004056c0 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/test_UP (-rw-r--r-- root root) found:
1: 00000000 0 FUNC GLOBAL DEFAULT UND printf
27: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
40: 00000000 0 FUNC GLOBAL DEFAULT UND popen
43: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy
45: 00000000 0 FUNC GLOBAL DEFAULT UND system
86: 00000000 0 FUNC GLOBAL DEFAULT UND sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/wpa_cli (-rw-r--r-- root root) found:
5: 00000000 0 FUNC GLOBAL DEFAULT UND printf
39: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/logcat (-rw-r--r-- root root) found:
23: 00000000 0 FUNC GLOBAL DEFAULT UND strcat
46: 00000000 0 FUNC GLOBAL DEFAULT UND mmap
67: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
84: 00000000 0 FUNC GLOBAL DEFAULT UND printf
90: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/xtables-multi (-rw-r--r-- root root) found:
2: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy
4: 00000000 0 FUNC GLOBAL DEFAULT UND printf
47: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
49: 00000000 0 FUNC GLOBAL DEFAULT UND strcat
83: 00000000 0 FUNC GLOBAL DEFAULT UND sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/hostapd_cli (-rw-r--r-- root root) found:
5: 00000000 0 FUNC GLOBAL DEFAULT UND printf
39: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/smbclient (-rw-r--r-- root root) found:
9: 00000000 0 FUNC GLOBAL DEFAULT UND printf
38: 00000000 0 FUNC GLOBAL DEFAULT UND system
76: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/impdbg (-rw-r--r-- root root) found:
25: 00000000 0 FUNC GLOBAL DEFAULT UND mmap
48: 00000000 0 FUNC GLOBAL DEFAULT UND printf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/getSensorType (-rw-r--r-- root root) found:
2: 00000000 0 FUNC GLOBAL DEFAULT UND printf
6: 00000000 0 FUNC GLOBAL DEFAULT UND system
12: 00000000 0 FUNC GLOBAL DEFAULT UND sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/webrtc_stream (-rw-r--r-- root root) found:
54: 00000000 0 FUNC GLOBAL DEFAULT UND sprintf
65: 00000000 0 FUNC GLOBAL DEFAULT UND printf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/iwconfig (-rw-r--r-- root root) found:
2: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy
5: 00000000 0 FUNC GLOBAL DEFAULT UND printf
17: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
54: 00407b30 0 FUNC GLOBAL DEFAULT UND sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/bin/hostapd (-rw-r--r-- root root) found:
1: 00000000 0 FUNC GLOBAL DEFAULT UND printf
90: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/etc/miio_client/miio_recv_line (-rw-r--r-- root root) found:
25: 00400a40 0 FUNC GLOBAL DEFAULT UND printf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/etc/miio_client/miio_send_line (-rw-r--r-- root root) found:
24: 00400a00 0 FUNC GLOBAL DEFAULT UND printf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/etc/miio_client/miio_client (-rw-r--r-- root root) found:
126: 00414de0 0 FUNC GLOBAL DEFAULT UND sprintf
164: 00414bb0 0 FUNC GLOBAL DEFAULT UND fprintf
201: 00414980 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/6225984-11075644.jffs2_new_extract/ucamera (-rw-r--r-- root root) found:
27: 00000000 0 FUNC GLOBAL DEFAULT UND strcat
56: 00000000 0 FUNC GLOBAL DEFAULT UND mmap
91: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
95: 00000000 0 FUNC GLOBAL DEFAULT UND sprintf
118: 00000000 0 FUNC GLOBAL DEFAULT UND printf
131: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/thirdlib/libmbedcrypto.so.0 (-rw-r--r-- 501 dialout) found:
463: 00064630 0 FUNC GLOBAL DEFAULT UND printf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/thirdlib/libssl.so.1.0.0 (-rw-r--r-- 501 dialout) found:
826: 00057840 0 FUNC GLOBAL DEFAULT UND fprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/thirdlib/libmp4v2.so.2.0.0 (-rw-r--r-- 501 dialout) found:
305: 0013db90 0 FUNC GLOBAL DEFAULT UND strcpy
411: 0013d8b0 0 FUNC GLOBAL DEFAULT UND sprintf
430: 0013d820 0 FUNC GLOBAL DEFAULT UND fprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/thirdlib/libcrypto.so.1.0.0 (-rw-r--r-- 501 dialout) found:
4087: 001710b0 0 FUNC GLOBAL DEFAULT UND sprintf
4123: 00170ec0 0 FUNC GLOBAL DEFAULT UND fprintf
4131: 00170e60 0 FUNC GLOBAL DEFAULT UND printf
4151: 00170d60 0 FUNC GLOBAL DEFAULT UND strcpy
4154: 00170d30 0 FUNC GLOBAL DEFAULT UND strcat
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/thirdlib/libzbar.so.0.2.0 (-rw-r--r-- 501 dialout) found:
95: 00022280 0 FUNC GLOBAL DEFAULT UND sprintf
136: 00022130 0 FUNC GLOBAL DEFAULT UND fprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/thirdlib/libcurl.so.4.3.0 (-rw-r--r-- 501 dialout) found:
79: 0004ec60 0 FUNC GLOBAL DEFAULT UND sprintf
179: 0004e760 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/thirdlib/libjson-c.so.2.0.1 (-rw-r--r-- 501 dialout) found:
137: 000084f0 0 FUNC GLOBAL DEFAULT UND fprintf
153: 00008410 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/thirdlib/libfftw3.so.3.4.4 (-rw-r--r-- 501 dialout) found:
292: 000f19b0 0 FUNC GLOBAL DEFAULT UND fprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/thirdlib/libfaac.so.0.0.0 (-rw-r--r-- 501 dialout) found:
49: 0000e0c0 0 FUNC GLOBAL DEFAULT UND sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/thirdlib/libnl-3.so.200.21.0 (-rw-r--r-- 501 dialout) found:
302: 00021d20 0 FUNC GLOBAL DEFAULT UND fprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/thirdlib/libnl-genl-3.so.200.21.0 (-rw-r--r-- 501 dialout) found:
72: 00005620 0 FUNC GLOBAL DEFAULT UND fprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/thirdlib/libmbedx509.so.0 (-rw-r--r-- 501 dialout) found:
199: 00012b40 0 FUNC GLOBAL DEFAULT UND printf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/usr/boa/boa (-rw-r--r-- 501 dialout) found:
3: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy
34: 00000000 0 FUNC GLOBAL DEFAULT UND mmap
45: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
46: 00000000 0 FUNC GLOBAL DEFAULT UND strcat
89: 00000000 0 FUNC GLOBAL DEFAULT UND sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/usr/www/cgi-bin/hello.cgi (-rw-r--r-- 501 dialout) found:
1: 00000000 0 FUNC GLOBAL DEFAULT UND printf
15: 00000000 0 FUNC GLOBAL DEFAULT UND sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/usr/bin/iperf (-rw-r--r-- 501 dialout) found:
70: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
95: 00000000 0 FUNC GLOBAL DEFAULT UND printf
104: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/lib/libutil-0.9.33.2.so (-rw-r--r-- 501 dialout) found:
39: 00000d40 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/lib/libdl-0.9.33.2.so (-rw-r--r-- 501 dialout) found:
34: 00002240 0 FUNC GLOBAL DEFAULT UND fprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/lib/libstdc++.so.6.0.17 (-rw-r--r-- 501 dialout) found:
2188: 000c3100 0 FUNC GLOBAL DEFAULT UND sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/lib/librt-0.9.33.2.so (-rw-r--r-- 501 dialout) found:
73: 000024a0 0 FUNC GLOBAL DEFAULT UND printf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/lib/libcrypt-0.9.33.2.so (-rw-r--r-- 501 dialout) found:
17: 00002010 0 FUNC GLOBAL DEFAULT UND strcpy
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/lib/libuClibc-0.9.33.2.so (-rw-r--r-- 501 dialout) found:
18: 0003b630 40 FUNC GLOBAL DEFAULT 7 strcpy
60: 0002fcf0 568 FUNC GLOBAL DEFAULT 7 popen
62: 0002f7b0 80 FUNC GLOBAL DEFAULT 7 printf
278: 00063cf0 184 FUNC WEAK DEFAULT 7 system
405: 0000b870 96 FUNC GLOBAL DEFAULT 7 mmap
533: 0002f860 64 FUNC GLOBAL DEFAULT 7 fprintf
545: 0003b3d0 52 FUNC GLOBAL DEFAULT 7 strcat
926: 0002f960 68 FUNC GLOBAL DEFAULT 7 sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/lib/libm-0.9.33.2.so (-rw-r--r-- 501 dialout) found:
140: 00009dd0 0 FUNC GLOBAL DEFAULT UND sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/lib/libpthread-0.9.33.2.so (-rw-r--r-- 501 dialout) found:
63: 0000a984 24 FUNC GLOBAL DEFAULT 8 system
273: 00011640 0 FUNC GLOBAL DEFAULT UND sprintf
317: 00011450 0 FUNC GLOBAL DEFAULT UND mmap
340: 00011340 0 FUNC GLOBAL DEFAULT UND printf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/bin/busybox (-rw-r--r-- 501 dialout) found:
4: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy
14: 00000000 0 FUNC GLOBAL DEFAULT UND popen
16: 00000000 0 FUNC GLOBAL DEFAULT UND printf
64: 00000000 0 FUNC GLOBAL DEFAULT UND system
121: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
125: 00000000 0 FUNC GLOBAL DEFAULT UND strcat
241: 00000000 0 FUNC GLOBAL DEFAULT UND sprintf
[+] Interesting function in ./logs/firmware/unblob_extracted/firmware_extract/2097216-5451840.squashfs_v4_le_extract/sbin/flash_erase (-rw-r--r-- 501 dialout) found:
2: 00000000 0 FUNC GLOBAL DEFAULT UND strcpy
4: 00000000 0 FUNC GLOBAL DEFAULT UND printf
17: 00000000 0 FUNC GLOBAL DEFAULT UND fprintf
33: 00000000 0 FUNC GLOBAL DEFAULT UND sprintf
[*] Found 56 binaries with interesting functions in 79 files (vulnerable functions: fprintf mmap popen printf sprintf strcat strcpy system)
