1 Star 0 Fork 0

JHLeeJnu / ROPgadget

加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
克隆/下载
贡献代码
同步代码
取消
提示: 由于 Git 不支持空文件夾,创建文件夹后会生成空的 .keep 文件
Loading...
README
BSD-3-Clause

ROPgadget Tool

This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF/PE/Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC and MIPS architectures. Since the version 5, ROPgadget has a new core which is written in Python using Capstone disassembly framework for the gadgets search engine - The older version can be found in the Archives directory but it will not be maintained.

Install

If you want to use ROPgadget, you have to install Capstone first.

For the Capstone's installation on nix machine:

$ sudo pip install capstone

Capstone supports multi-platforms (windows, ios, android, cygwin...). For the cross-compilation, please refer to the https://github.com/aquynh/capstone/blob/master/COMPILE.TXT file.

After Capstone is installed, ROPgadget can be used as a standalone tool:

$ ROPgadget.py

Or installed into the Python site-packages library, and executed from $PATH.

$ python setup.py install
$ ROPgadget

Or installed from PyPi

$ pip install ropgadget
$ ROPgadget

Usage

usage: ROPgadget.py [-h] [-v] [-c] [--binary <binary>] [--opcode <opcodes>]
                    [--string <string>] [--memstr <string>] [--depth <nbyte>]
                    [--only <key>] [--filter <key>] [--range <start-end>]
                    [--badbytes <byte>] [--rawArch <arch>] [--rawMode <mode>]
                    [--rawEndian <endian>] [--re <re>] [--offset <hexaddr>]
                    [--ropchain] [--thumb] [--console] [--norop] [--nojop]
                    [--callPreceded] [--nosys] [--multibr] [--all] [--noinstr]
                    [--dump]

optional arguments:
    -h, --help           show this help message and exit
    -v, --version        Display the ROPgadget's version
    -c, --checkUpdate    Checks if a new version is available
    --binary <binary>    Specify a binary filename to analyze
    --opcode <opcodes>   Search opcode in executable segment
    --string <string>    Search string in readable segment
    --memstr <string>    Search each byte in all readable segment
    --depth <nbyte>      Depth for search engine (default 10)
    --only <key>         Only show specific instructions
    --filter <key>       Suppress specific instructions
    --range <start-end>  Search between two addresses (0x...-0x...)
    --badbytes <byte>    Rejects specific bytes in the gadget's address
    --rawArch <arch>     Specify an arch for a raw file
    --rawMode <mode>     Specify a mode for a raw file
    --rawEndian <endian> Specify an endianness for a raw file
    --re <re>            Regular expression
    --offset <hexaddr>   Specify an offset for gadget addresses
    --ropchain           Enable the ROP chain generation
    --thumb              Use the thumb mode for the search engine (ARM only)
    --console            Use an interactive console for search engine
    --norop              Disable ROP search engine
    --nojop              Disable JOP search engine
    --callPreceded       Only show gadgets which are call-preceded
    --nosys              Disable SYS search engine
    --multibr            Enable multiple branch gadgets
    --all                Disables the removal of duplicate gadgets
    --noinstr            Disable the gadget instructions console printing
    --dump               Outputs the gadget bytes

How can I contribute ?

  • Use Z3 to solve the ROP chain
  • Add system gadgets for PPC, Sparc, ARM64 (Gadgets.addSYSGadgets())
  • Manage big endian in Mach-O format like the ELF classe.
  • Everything you think is cool :)

Bugs/Patches/Contact

Please report bugs, submit pull requests, etc. on github at https://github.com/JonathanSalwan/ROPgadget The offical page is on shell-storm.org at http://shell-storm.org/project/ROPgadget/

License

See COPYING and the license header on all source files. For the files in the dependencies/ there are individual licenses in each folder.

Screenshots

x64

ARM

Sparc

MIPS

PowerPC

ROP chain

This is the software license for the ROPgadget project. Copyright (c) 2016. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of the developers nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

简介

This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC and MIPS architectures. 展开 收起
BSD-3-Clause
取消

发行版

暂无发行版

贡献者

全部

近期动态

加载更多
不能加载更多了
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化
1
https://gitee.com/jhleejnu/ROPgadget.git
git@gitee.com:jhleejnu/ROPgadget.git
jhleejnu
ROPgadget
ROPgadget
master

搜索帮助

344bd9b3 5694891 D2dac590 5694891