exploit-software9.txt

                                     =-------------------------=
                                     | [0x4003b0]              |
                                     | main:                   | // Main Function
                                     | (fcn) sym.main 260      |
                                     | addiu sp, sp, -0x28     |
                                     | sw ra, 0x24(sp)         |
                                     | sw fp, 0x20(sp)         |
                                     | move fp, sp             |
                                     | lui gp, 0x42            |
                                     | addiu gp, gp, 0x680     |
                                     | sw gp, 0x10(sp)         |
                                     | sw a0, 0x28(fp)         | // Store argc
                                     | sw a1, 0x2c(fp)         | // Store argv[]
                                     | lw v0, 0x28(fp)         | // Load argc into the $v0 register
                                     | slti v0, v0, 2          | // Set $v0 to 1 if the value of $v0 is less than 2, otherwise set it to 0.
                                     | beqz v0, 0x400418 ;[a]  | // If $v0 is equal take the "true" branch. (Branch if Equal to Zero)
                                     | nop                     |
                                     =-------------------------=
                                           t f
                           .---------------' '--------------------------------.
                           |                                                  |
                           |                                                  |
                     =-------------------------=                  =-----------------------=
                     |  0x400418               |                  |  0x4003e4             |
                     | lw v0, 0x2c(fp)         | // load argv[]   | lw v0, 0x2c(fp)       |
                     | addiu v0, v0, 4         | // offset +4     | lw v1, (v0)           |
                     | lw v0, (v0)             | // load argv[1]  | lui v0, 0x40          |
                     | move a0, v0             |                  | addiu a0, v0, 0x70f0  | // Load Format String
                     | lw v0, -0x7fd0(gp)      | // $v0 = atoi    | move a1, v1           | // Load argv[0]
                     | move t9, v0             | // $t9 = $v0     | lw v0, -0x7fd4(gp)    | // Resolve printf pointer and load it into $v0
                     | jalr t9  ; atoi         | // call atoi     | move t9, v0           | // Move $v0 into $t9
                     | nop                     |                  | jalr t9   ; printf    | // Call printf which is in $t9 (Jump and Link Register)
                     | lw gp, 0x10(fp)         |                  | nop                   |
                     | sw v0, 0x18(fp)         | // int a         | lw gp, 0x10(fp)       |
                     | lw v0, 0x18(fp)         | // load int a    | addiu v0, zero, 1     | // Return 1
                     | slti v0, v0, 5          | // if < 5        | j 0x40049c ;[d]       | // Exit function
                     | beqz v0, 0x400478 ;[b]  | // true if $v0=0 | nop                   |
                     | nop                     |                  =-----------------------=
                     =-------------------------=                             v
                           t f                                               |
             .-------------' '---------------------------------.             '--.
             |                                                 |                |
             |                                                 |                |
  =-----------------------=                       =-----------------------=     |
  |  0x400478             |                       |  0x400450             |     |
  | lui v0, 0x40          |                       | lui v0, 0x40          |     |  // Block 0x400450 does the same as 0x400478
  | addiu a0, v0, 0x7118  | // load format string | addiu a0, v0, 0x7104  |     |  // Just needs to jump due to where it sits.
  | lw a1, 0x18(fp)       | // int a printf arg   | lw a1, 0x18(fp)       |     |
  | lw v0, -0x7fd4(gp)    | // load printf in $v0 | lw v0, -0x7fd4(gp)    |     |
  | move t9, v0           | // move $v0 to $t9    | move t9, v0           |     |
  | jalr t9  ; printf     | // call $t9 (printf)  | jalr t9 ; printf      |     |
  | nop                   |                       | nop                   |     |
  | lw gp, 0x10(fp)       |                       | lw gp, 0x10(fp)       |     |
  =-----------------------=                       | j 0x400498 ;[c]       |     | // Jump to Return 0 due to memory position
      v                                           | nop                   |     |
      |                                           =-----------------------=     |
      '-----------------.                             v                         |
                        .-----------------------------'                         |
                        |                                                       |
                        |                                                       |
                    =----------------=                                          |
                    |  0x400498      |                                          |
                    | move v0, zero  |  // Return 0                             |
                    =----------------=                                          |
                        v                                                       |
                        '-------------.-----------------------------------------'
                                      |
                                      |
                                  =---------------------=
                                  |  0x40049c           |
                                  | move sp, fp         |
                                  | lw ra, 0x24(sp)     |
                                  | lw fp, 0x20(sp)     |
                                  | addiu sp, sp, 0x28  |
                                  | jr ra               | // Function be gone!
                                  =---------------------=