3615 lines
No EOL
103 KiB
Text
3615 lines
No EOL
103 KiB
Text
NAME=rop search with maxhits
|
|
FILE=bins/elf/varsub
|
|
CMDS=<<EOF
|
|
e search.maxhits=1
|
|
/Rq pop r15
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0040052c: pop r12; pop r13; pop r14; pop r15; ret;
|
|
EOF
|
|
RUN
|
|
|
|
NAME=rop search without maxhits
|
|
FILE=bins/elf/varsub
|
|
CMDS=/Rq pop r15~?
|
|
EXPECT=<<EOF
|
|
7
|
|
EOF
|
|
RUN
|
|
|
|
NAME=rop search without maxhits
|
|
FILE=bins/elf/varsub
|
|
CMDS=<<EOF
|
|
e search.maxhits=2
|
|
/Rq pop r15~?
|
|
EOF
|
|
EXPECT=<<EOF
|
|
2
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search all rop gadgets
|
|
FILE=bins/elf/analysis/x86-helloworld-phdr
|
|
ARGS=-n
|
|
CMDS=<<EOF
|
|
e asm.nbytes=8
|
|
e asm.arch=x86
|
|
e asm.bits=32
|
|
/R
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x000000b4 cd80 int 0x80
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 15
|
|
|
|
0x000000b5 80b801000000b9 cmp byte [eax+0x01], 0xb9
|
|
0x000000bc 0000 add byte [eax], al
|
|
0x000000be 0000 add byte [eax], al
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 14
|
|
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 13
|
|
|
|
0x000000b7 0100 add dword [eax], eax
|
|
0x000000b9 0000 add byte [eax], al
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 12
|
|
|
|
0x000000b8 0000 add byte [eax], al
|
|
0x000000ba 00b900000000 add byte [ecx], bh
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 11
|
|
|
|
0x000000b9 0000 add byte [eax], al
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 10
|
|
|
|
0x000000ba 00b900000000 add byte [ecx], bh
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 9
|
|
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 8
|
|
|
|
0x000000bc 0000 add byte [eax], al
|
|
0x000000be 0000 add byte [eax], al
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 7
|
|
|
|
0x000000be 0000 add byte [eax], al
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 5
|
|
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 3
|
|
|
|
0x000000c2 c3 ret
|
|
Gadget size: 1
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets with a regexp
|
|
FILE=bins/elf/analysis/x86-helloworld-phdr
|
|
ARGS=-n
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e asm.bits=32
|
|
/R/ mov e[abcd]x
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x000000b4 cd80 int 0x80
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 15
|
|
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 13
|
|
|
|
0x000000b7 0100 add dword [eax], eax
|
|
0x000000b9 0000 add byte [eax], al
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 12
|
|
|
|
0x000000b9 0000 add byte [eax], al
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 10
|
|
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 8
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets and show them linearly
|
|
FILE=bins/elf/analysis/x86-helloworld-phdr
|
|
ARGS=-n
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e asm.bits=32
|
|
/Rq
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x000000b4: int 0x80; mov eax, 0x01; mov ecx, 0x00; int 0x80; ret;
|
|
0x000000b5: cmp byte [eax+0x01], 0xb9; add byte [eax], al; add byte [eax], al; int 0x80; ret;
|
|
0x000000b6: mov eax, 0x01; mov ecx, 0x00; int 0x80; ret;
|
|
0x000000b7: add dword [eax], eax; add byte [eax], al; mov ecx, 0x00; int 0x80; ret;
|
|
0x000000b8: add byte [eax], al; add byte [ecx], bh; int 0x80; ret;
|
|
0x000000b9: add byte [eax], al; mov ecx, 0x00; int 0x80; ret;
|
|
0x000000ba: add byte [ecx], bh; int 0x80; ret;
|
|
0x000000bb: mov ecx, 0x00; int 0x80; ret;
|
|
0x000000bc: add byte [eax], al; add byte [eax], al; int 0x80; ret;
|
|
0x000000be: add byte [eax], al; int 0x80; ret;
|
|
0x000000c0: int 0x80; ret;
|
|
0x000000c2: ret;
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets with filter
|
|
FILE=bins/elf/analysis/x86-helloworld-phdr
|
|
ARGS=-n
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e asm.bits=32
|
|
/R ecx
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x000000b4 cd80 int 0x80
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 15
|
|
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 13
|
|
|
|
0x000000b7 0100 add dword [eax], eax
|
|
0x000000b9 0000 add byte [eax], al
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 12
|
|
|
|
0x000000b8 0000 add byte [eax], al
|
|
0x000000ba 00b900000000 add byte [ecx], bh
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 11
|
|
|
|
0x000000b9 0000 add byte [eax], al
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 10
|
|
|
|
0x000000ba 00b900000000 add byte [ecx], bh
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 9
|
|
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 8
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets with filter and output JSON
|
|
FILE=bins/elf/analysis/x86-helloworld-phdr
|
|
ARGS=-n
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e asm.bits=32
|
|
/Rj ecx
|
|
EOF
|
|
EXPECT=<<EOF
|
|
[{"opcodes":[{"offset":180,"size":2,"opcode":"int 0x80","type":"swi"},{"offset":182,"size":5,"opcode":"mov eax, 0x01","type":"mov"},{"offset":187,"size":5,"opcode":"mov ecx, 0x00","type":"mov"},{"offset":192,"size":2,"opcode":"int 0x80","type":"swi"},{"offset":194,"size":1,"opcode":"ret","type":"ret"}],"retaddr":194,"size":15},{"opcodes":[{"offset":182,"size":5,"opcode":"mov eax, 0x01","type":"mov"},{"offset":187,"size":5,"opcode":"mov ecx, 0x00","type":"mov"},{"offset":192,"size":2,"opcode":"int 0x80","type":"swi"},{"offset":194,"size":1,"opcode":"ret","type":"ret"}],"retaddr":194,"size":13},{"opcodes":[{"offset":183,"size":2,"opcode":"add dword [eax], eax","type":"add"},{"offset":185,"size":2,"opcode":"add byte [eax], al","type":"add"},{"offset":187,"size":5,"opcode":"mov ecx, 0x00","type":"mov"},{"offset":192,"size":2,"opcode":"int 0x80","type":"swi"},{"offset":194,"size":1,"opcode":"ret","type":"ret"}],"retaddr":194,"size":12},{"opcodes":[{"offset":184,"size":2,"opcode":"add byte [eax], al","type":"add"},{"offset":186,"size":6,"opcode":"add byte [ecx], bh","type":"add"},{"offset":192,"size":2,"opcode":"int 0x80","type":"swi"},{"offset":194,"size":1,"opcode":"ret","type":"ret"}],"retaddr":194,"size":11},{"opcodes":[{"offset":185,"size":2,"opcode":"add byte [eax], al","type":"add"},{"offset":187,"size":5,"opcode":"mov ecx, 0x00","type":"mov"},{"offset":192,"size":2,"opcode":"int 0x80","type":"swi"},{"offset":194,"size":1,"opcode":"ret","type":"ret"}],"retaddr":194,"size":10},{"opcodes":[{"offset":186,"size":6,"opcode":"add byte [ecx], bh","type":"add"},{"offset":192,"size":2,"opcode":"int 0x80","type":"swi"},{"offset":194,"size":1,"opcode":"ret","type":"ret"}],"retaddr":194,"size":9},{"opcodes":[{"offset":187,"size":5,"opcode":"mov ecx, 0x00","type":"mov"},{"offset":192,"size":2,"opcode":"int 0x80","type":"swi"},{"offset":194,"size":1,"opcode":"ret","type":"ret"}],"retaddr":194,"size":8}]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets with a regex of the form (a|b)
|
|
FILE=bins/elf/analysis/x86-helloworld-phdr
|
|
ARGS=-n
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e asm.bits=32
|
|
/R/ "(ecx|eax)"
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x000000b4 cd80 int 0x80
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 15
|
|
|
|
0x000000b5 80b801000000b9 cmp byte [eax+0x01], 0xb9
|
|
0x000000bc 0000 add byte [eax], al
|
|
0x000000be 0000 add byte [eax], al
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 14
|
|
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 13
|
|
|
|
0x000000b7 0100 add dword [eax], eax
|
|
0x000000b9 0000 add byte [eax], al
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 12
|
|
|
|
0x000000b8 0000 add byte [eax], al
|
|
0x000000ba 00b900000000 add byte [ecx], bh
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 11
|
|
|
|
0x000000b9 0000 add byte [eax], al
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 10
|
|
|
|
0x000000ba 00b900000000 add byte [ecx], bh
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 9
|
|
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 8
|
|
|
|
0x000000bc 0000 add byte [eax], al
|
|
0x000000be 0000 add byte [eax], al
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 7
|
|
|
|
0x000000be 0000 add byte [eax], al
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 5
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets with another end gadget as part of it.
|
|
FILE=bins/elf/analysis/unoriginal
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
e gadget.len=15
|
|
e search.from=0x08048340
|
|
e search.to=0x08048400
|
|
/R push esp
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x08048350 fff4 push esp
|
|
0x08048352 6690 nop
|
|
0x08048354 6690 nop
|
|
0x08048356 6690 nop
|
|
0x08048358 6690 nop
|
|
0x0804835a 6690 nop
|
|
0x0804835c 6690 nop
|
|
0x0804835e 6690 nop
|
|
0x08048360 8b1c24 mov ebx, dword [esp]
|
|
0x08048363 c3 ret
|
|
Gadget size: 20
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop with sequence.
|
|
FILE=bins/elf/analysis/x86-helloworld-gcc
|
|
CMDS=/R "push esi;push ebx"
|
|
EXPECT=<<EOF
|
|
0x08048421 57 push edi
|
|
0x08048422 31ff xor edi, edi
|
|
0x08048424 56 push esi
|
|
0x08048425 53 push ebx
|
|
0x08048426 e805ffffff call 0x8048330
|
|
Gadget size: 10
|
|
|
|
0x08048422 31ff xor edi, edi
|
|
0x08048424 56 push esi
|
|
0x08048425 53 push ebx
|
|
0x08048426 e805ffffff call 0x8048330
|
|
Gadget size: 9
|
|
|
|
0x08048424 56 push esi
|
|
0x08048425 53 push ebx
|
|
0x08048426 e805ffffff call 0x8048330
|
|
Gadget size: 7
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop with regex sequence.
|
|
FILE=bins/elf/analysis/x86-helloworld-gcc
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
/R/ "push esi;push ebx"
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x08048421 57 push edi
|
|
0x08048422 31ff xor edi, edi
|
|
0x08048424 56 push esi
|
|
0x08048425 53 push ebx
|
|
0x08048426 e805ffffff call 0x8048330
|
|
Gadget size: 10
|
|
|
|
0x08048422 31ff xor edi, edi
|
|
0x08048424 56 push esi
|
|
0x08048425 53 push ebx
|
|
0x08048426 e805ffffff call 0x8048330
|
|
Gadget size: 9
|
|
|
|
0x08048424 56 push esi
|
|
0x08048425 53 push ebx
|
|
0x08048426 e805ffffff call 0x8048330
|
|
Gadget size: 7
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop for AVR
|
|
FILE=malloc://512
|
|
CMDS=<<EOF
|
|
e asm.arch=avr
|
|
e cfg.bigendian=false
|
|
e scr.color=false
|
|
wx 11241fbecfefd8e0debfcdbf12e0a0e0b1e0e6e3f4e302c005900d92a431b107d9f722e0a4e1b2e001c01d92ae3cb207e1f710e0c2e6d0e004c02197fe010e94041ac136d107c9f70e944f090c9456160c940000ef92ff920f931f93cf93df93cdb7deb7c054d1090fb6f894debf0fbecdbf6ce071e08fe192e00e946b04ce0101967c018e010f5c1f4ffc011192e017f107e1f720e330e0a7016ae08fe192e00e94d8080297f8f0c801d701fd01ee19ff092d91222321f0fc012193cf01f6cfe00ff11f108260e071e0c8010e949816892b49f46de171e08fe192e00e946b0481e090e008c066e471e08fe192e00e946b0480e090e0c05cdf4f0fb6f894debf0fbecdbfdf91cf911f910f91ff90ef9008956de671e08fe192e00e946b0485b1805885b908956fe771e08fe192e00e946b048bb180588bb908956de671e08fe192e00e946b0485b1805885b985b1805885b985b1805885b908956fe771e08fe192e00e946b048bb180588bb98bb180588bb98bb180588bb908950f931f93cf93df93cdb7deb727970fb6f894debf0fbecdbf9c018e010f5f1f4fd801ad01401b510bf90191919f01992311f09d93f6cffa01e00ff11f10826fe871e0c8010e949816892b81f40e948c00892bf9f027960fb6f894debf0fbecdbfdf91cf911f910f910c940f0163e971e0c8010e949816892b61f427960fb6f894debf0fbecdbf
|
|
/R ldi
|
|
q
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0000000e a0e0 ldi r26, 0x00
|
|
0x00000010 b1e0 ldi r27, 0x01
|
|
0x00000012 e6e3 ldi r30, 0x36
|
|
0x00000014 f4e3 ldi r31, 0x34
|
|
0x00000016 02c0 rjmp 0x1c
|
|
Gadget size: 10
|
|
|
|
0x00000010 b1e0 ldi r27, 0x01
|
|
0x00000012 e6e3 ldi r30, 0x36
|
|
0x00000014 f4e3 ldi r31, 0x34
|
|
0x00000016 02c0 rjmp 0x1c
|
|
Gadget size: 8
|
|
|
|
0x00000012 e6e3 ldi r30, 0x36
|
|
0x00000014 f4e3 ldi r31, 0x34
|
|
0x00000016 02c0 rjmp 0x1c
|
|
Gadget size: 6
|
|
|
|
0x00000014 f4e3 ldi r31, 0x34
|
|
0x00000016 02c0 rjmp 0x1c
|
|
Gadget size: 4
|
|
|
|
0x00000020 d9f7 brne 0x18
|
|
0x00000022 22e0 ldi r18, 0x02
|
|
0x00000024 a4e1 ldi r26, 0x14
|
|
0x00000026 b2e0 ldi r27, 0x02
|
|
0x00000028 01c0 rjmp 0x2c
|
|
Gadget size: 10
|
|
|
|
0x00000022 22e0 ldi r18, 0x02
|
|
0x00000024 a4e1 ldi r26, 0x14
|
|
0x00000026 b2e0 ldi r27, 0x02
|
|
0x00000028 01c0 rjmp 0x2c
|
|
Gadget size: 8
|
|
|
|
0x00000024 a4e1 ldi r26, 0x14
|
|
0x00000026 b2e0 ldi r27, 0x02
|
|
0x00000028 01c0 rjmp 0x2c
|
|
Gadget size: 6
|
|
|
|
0x00000026 b2e0 ldi r27, 0x02
|
|
0x00000028 01c0 rjmp 0x2c
|
|
Gadget size: 4
|
|
|
|
0x00000030 e1f7 brne 0x2a
|
|
0x00000032 10e0 ldi r17, 0x00
|
|
0x00000034 c2e6 ldi r28, 0x62
|
|
0x00000036 d0e0 ldi r29, 0x00
|
|
0x00000038 04c0 rjmp 0x42
|
|
Gadget size: 10
|
|
|
|
0x00000032 10e0 ldi r17, 0x00
|
|
0x00000034 c2e6 ldi r28, 0x62
|
|
0x00000036 d0e0 ldi r29, 0x00
|
|
0x00000038 04c0 rjmp 0x42
|
|
Gadget size: 8
|
|
|
|
0x00000034 c2e6 ldi r28, 0x62
|
|
0x00000036 d0e0 ldi r29, 0x00
|
|
0x00000038 04c0 rjmp 0x42
|
|
Gadget size: 6
|
|
|
|
0x00000036 d0e0 ldi r29, 0x00
|
|
0x00000038 04c0 rjmp 0x42
|
|
Gadget size: 4
|
|
|
|
0x00000072 6ce0 ldi r22, 0x0c
|
|
0x00000074 71e0 ldi r23, 0x01
|
|
0x00000076 8fe1 ldi r24, 0x1f
|
|
0x00000078 92e0 ldi r25, 0x02
|
|
0x0000007a 0e946b04 call 0x8d6
|
|
Gadget size: 12
|
|
|
|
0x00000074 71e0 ldi r23, 0x01
|
|
0x00000076 8fe1 ldi r24, 0x1f
|
|
0x00000078 92e0 ldi r25, 0x02
|
|
0x0000007a 0e946b04 call 0x8d6
|
|
Gadget size: 10
|
|
|
|
0x00000076 8fe1 ldi r24, 0x1f
|
|
0x00000078 92e0 ldi r25, 0x02
|
|
0x0000007a 0e946b04 call 0x8d6
|
|
Gadget size: 8
|
|
|
|
0x00000078 92e0 ldi r25, 0x02
|
|
0x0000007a 0e946b04 call 0x8d6
|
|
Gadget size: 6
|
|
|
|
0x00000098 a701 movw r20, r14
|
|
0x0000009a 6ae0 ldi r22, 0x0a
|
|
0x0000009c 8fe1 ldi r24, 0x1f
|
|
0x0000009e 92e0 ldi r25, 0x02
|
|
0x000000a0 0e94d808 call 0x11b0
|
|
Gadget size: 12
|
|
|
|
0x0000009a 6ae0 ldi r22, 0x0a
|
|
0x0000009c 8fe1 ldi r24, 0x1f
|
|
0x0000009e 92e0 ldi r25, 0x02
|
|
0x000000a0 0e94d808 call 0x11b0
|
|
Gadget size: 10
|
|
|
|
0x0000009c 8fe1 ldi r24, 0x1f
|
|
0x0000009e 92e0 ldi r25, 0x02
|
|
0x000000a0 0e94d808 call 0x11b0
|
|
Gadget size: 8
|
|
|
|
0x0000009e 92e0 ldi r25, 0x02
|
|
0x000000a0 0e94d808 call 0x11b0
|
|
Gadget size: 6
|
|
|
|
0x000000c4 1082 st Z, r1
|
|
0x000000c6 60e0 ldi r22, 0x00
|
|
0x000000c8 71e0 ldi r23, 0x01
|
|
0x000000ca c801 movw r24, r16
|
|
0x000000cc 0e949816 call 0x2d30
|
|
Gadget size: 12
|
|
|
|
0x000000c6 60e0 ldi r22, 0x00
|
|
0x000000c8 71e0 ldi r23, 0x01
|
|
0x000000ca c801 movw r24, r16
|
|
0x000000cc 0e949816 call 0x2d30
|
|
Gadget size: 10
|
|
|
|
0x000000c8 71e0 ldi r23, 0x01
|
|
0x000000ca c801 movw r24, r16
|
|
0x000000cc 0e949816 call 0x2d30
|
|
Gadget size: 8
|
|
|
|
0x000000d4 6de1 ldi r22, 0x1d
|
|
0x000000d6 71e0 ldi r23, 0x01
|
|
0x000000d8 8fe1 ldi r24, 0x1f
|
|
0x000000da 92e0 ldi r25, 0x02
|
|
0x000000dc 0e946b04 call 0x8d6
|
|
Gadget size: 12
|
|
|
|
0x000000de 6b04 cpc r6, r11
|
|
0x000000e0 81e0 ldi r24, 0x01
|
|
0x000000e2 90e0 ldi r25, 0x00
|
|
0x000000e4 08c0 rjmp 0xf6
|
|
Gadget size: 8
|
|
|
|
0x000000e0 81e0 ldi r24, 0x01
|
|
0x000000e2 90e0 ldi r25, 0x00
|
|
0x000000e4 08c0 rjmp 0xf6
|
|
Gadget size: 6
|
|
|
|
0x000000e2 90e0 ldi r25, 0x00
|
|
0x000000e4 08c0 rjmp 0xf6
|
|
Gadget size: 4
|
|
|
|
0x000000e6 66e4 ldi r22, 0x46
|
|
0x000000e8 71e0 ldi r23, 0x01
|
|
0x000000ea 8fe1 ldi r24, 0x1f
|
|
0x000000ec 92e0 ldi r25, 0x02
|
|
0x000000ee 0e946b04 call 0x8d6
|
|
Gadget size: 12
|
|
|
|
0x00000112 6de6 ldi r22, 0x6d
|
|
0x00000114 71e0 ldi r23, 0x01
|
|
0x00000116 8fe1 ldi r24, 0x1f
|
|
0x00000118 92e0 ldi r25, 0x02
|
|
0x0000011a 0e946b04 call 0x8d6
|
|
Gadget size: 12
|
|
|
|
0x00000126 6fe7 ldi r22, 0x7f
|
|
0x00000128 71e0 ldi r23, 0x01
|
|
0x0000012a 8fe1 ldi r24, 0x1f
|
|
0x0000012c 92e0 ldi r25, 0x02
|
|
0x0000012e 0e946b04 call 0x8d6
|
|
Gadget size: 12
|
|
|
|
0x000001b6 1082 st Z, r1
|
|
0x000001b8 6fe8 ldi r22, 0x8f
|
|
0x000001ba 71e0 ldi r23, 0x01
|
|
0x000001bc c801 movw r24, r16
|
|
0x000001be 0e949816 call 0x2d30
|
|
Gadget size: 12
|
|
|
|
0x000001b8 6fe8 ldi r22, 0x8f
|
|
0x000001ba 71e0 ldi r23, 0x01
|
|
0x000001bc c801 movw r24, r16
|
|
0x000001be 0e949816 call 0x2d30
|
|
Gadget size: 10
|
|
|
|
0x000001e4 0f01 movw r0, r30
|
|
0x000001e6 63e9 ldi r22, 0x93
|
|
0x000001e8 71e0 ldi r23, 0x01
|
|
0x000001ea c801 movw r24, r16
|
|
0x000001ec 0e949816 call 0x2d30
|
|
Gadget size: 12
|
|
|
|
0x000001e6 63e9 ldi r22, 0x93
|
|
0x000001e8 71e0 ldi r23, 0x01
|
|
0x000001ea c801 movw r24, r16
|
|
0x000001ec 0e949816 call 0x2d30
|
|
Gadget size: 10
|
|
|
|
EOF
|
|
EXPECT_ERR=
|
|
RUN
|
|
|
|
|
|
NAME=search rop gadgets given the detailed stack change (=0)
|
|
FILE=bins/arm/crackme.arm32.bin
|
|
CMDS=<<EOF
|
|
e asm.arch=arm
|
|
e asm.bits=32
|
|
e cfg.bigendian=false
|
|
/Rs "=0"
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Gadget 0x900
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r3 r6 r8 r9 r11 r12 sp
|
|
Register dependencies:
|
|
Memory Read: r1 Value: 0x4
|
|
|
|
Gadget 0x934
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r3 r4 r5 r6 r8 r11 r12 sp
|
|
Register dependencies:
|
|
Memory Read: r1 Value: 0x80007ab
|
|
|
|
Gadget 0xc0c
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0xc10
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10cc
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d0
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d4
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d8
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1120
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1890
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1894
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ecc
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed0
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed4
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed8
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1edc
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets given the detailed stack change (<0x2000)
|
|
FILE=bins/arm/crackme.arm32.bin
|
|
CMDS=<<EOF
|
|
e asm.arch=arm
|
|
e asm.bits=32
|
|
e cfg.bigendian=false
|
|
/Rs "<0x2000"
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Gadget 0x900
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r3 r6 r8 r9 r11 r12 sp
|
|
Register dependencies:
|
|
Memory Read: r1 Value: 0x4
|
|
|
|
Gadget 0x934
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r3 r4 r5 r6 r8 r11 r12 sp
|
|
Register dependencies:
|
|
Memory Read: r1 Value: 0x80007ab
|
|
|
|
Gadget 0xc0c
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0xc10
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10cc
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d0
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d4
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d8
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1120
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1890
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1894
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ecc
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed0
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed4
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed8
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1edc
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets given the detailed stack change (<=0x2000)
|
|
FILE=bins/arm/crackme.arm32.bin
|
|
CMDS=<<EOF
|
|
e asm.arch=arm
|
|
e asm.bits=32
|
|
e cfg.bigendian=false
|
|
/Rs "<=0x2000"
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Gadget 0x900
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r3 r6 r8 r9 r11 r12 sp
|
|
Register dependencies:
|
|
Memory Read: r1 Value: 0x4
|
|
|
|
Gadget 0x934
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r3 r4 r5 r6 r8 r11 r12 sp
|
|
Register dependencies:
|
|
Memory Read: r1 Value: 0x80007ab
|
|
|
|
Gadget 0xc0c
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0xc10
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10cc
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d0
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d4
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d8
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1120
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1890
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1894
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ecc
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed0
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed4
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed8
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1edc
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets given the detailed stack change (>0x1)
|
|
FILE=bins/arm/elf/hello-linux-arm64
|
|
CMDS=<<EOF
|
|
/Rs ">0x1"
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Gadget 0x401a1c
|
|
Stack change: 0x4b0
|
|
Changed registers: x21 x22 x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x401a20
|
|
Stack change: 0x4b0
|
|
Changed registers: x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x401a24
|
|
Stack change: 0x4b0
|
|
Changed registers: x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x401a28
|
|
Stack change: 0x4b0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x402438
|
|
Stack change: 0x970
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x40243c
|
|
Stack change: 0x970
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x402440
|
|
Stack change: 0x970
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x402444
|
|
Stack change: 0x970
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x403d94
|
|
Stack change: 0x600
|
|
Changed registers: x21 x22 x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x403d98
|
|
Stack change: 0x600
|
|
Changed registers: x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x403d9c
|
|
Stack change: 0x600
|
|
Changed registers: x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x403da0
|
|
Stack change: 0x600
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x405c5c
|
|
Stack change: 0x2180
|
|
Changed registers: x19 x20 x12 x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x405c60
|
|
Stack change: 0x2180
|
|
Changed registers: x12 x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x405c64
|
|
Stack change: 0x2180
|
|
Changed registers: x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x405c68
|
|
Stack change: 0x2180
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4098e8
|
|
Stack change: 0x2180
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4098ec
|
|
Stack change: 0x2180
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4098f0
|
|
Stack change: 0x2180
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x412714
|
|
Stack change: 0x460
|
|
Changed registers: x0 x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x20
|
|
|
|
Gadget 0x412718
|
|
Stack change: 0x460
|
|
Changed registers: x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x41271c
|
|
Stack change: 0x460
|
|
Changed registers: x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x412720
|
|
Stack change: 0x460
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4128f4
|
|
Stack change: 0x470
|
|
Changed registers: x19 x20 x21 x22 x25 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4128f8
|
|
Stack change: 0x470
|
|
Changed registers: x21 x22 x25 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4128fc
|
|
Stack change: 0x470
|
|
Changed registers: x25 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x412900
|
|
Stack change: 0x470
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4129a8
|
|
Stack change: 0x1030
|
|
Changed registers: x29 x30 x12 x19 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4129ac
|
|
Stack change: 0x1030
|
|
Changed registers: x12 x19 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4129b0
|
|
Stack change: 0x1030
|
|
Changed registers: x19 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x413234
|
|
Stack change: 0x470
|
|
Changed registers: x21 x22 x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x413238
|
|
Stack change: 0x470
|
|
Changed registers: x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x41323c
|
|
Stack change: 0x470
|
|
Changed registers: x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x421ecc
|
|
Stack change: 0xb0
|
|
Changed registers: x21 x22 x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x421ed0
|
|
Stack change: 0xb0
|
|
Changed registers: x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x421ed4
|
|
Stack change: 0xb0
|
|
Changed registers: x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x421ed8
|
|
Stack change: 0xb0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4236e8
|
|
Stack change: 0x250
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4236ec
|
|
Stack change: 0x250
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4236f0
|
|
Stack change: 0x250
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4236f4
|
|
Stack change: 0x250
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x423ee0
|
|
Stack change: 0xc0
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x423ee4
|
|
Stack change: 0xc0
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x423ee8
|
|
Stack change: 0xc0
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x423eec
|
|
Stack change: 0xc0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4249c4
|
|
Stack change: 0x7c0
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4249c8
|
|
Stack change: 0x7c0
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4249cc
|
|
Stack change: 0x7c0
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4249d0
|
|
Stack change: 0x7c0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x425aa8
|
|
Stack change: 0x4b0
|
|
Changed registers: x29 x30 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x425aac
|
|
Stack change: 0x4b0
|
|
Changed registers: x29 x30 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x434d0c
|
|
Stack change: 0x870
|
|
Changed registers: x23 x24 x25 x26 x27 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x434d10
|
|
Stack change: 0x870
|
|
Changed registers: x25 x26 x27 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x434d14
|
|
Stack change: 0x870
|
|
Changed registers: x27 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x434d18
|
|
Stack change: 0x870
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x435dc0
|
|
Stack change: 0x8a0
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x435dc4
|
|
Stack change: 0x8a0
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x435dc8
|
|
Stack change: 0x8a0
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x435dcc
|
|
Stack change: 0x8a0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43bfe4
|
|
Stack change: 0x420
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43bfe8
|
|
Stack change: 0x420
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43bfec
|
|
Stack change: 0x420
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43bff0
|
|
Stack change: 0x420
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43ce34
|
|
Stack change: 0x110
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43ce38
|
|
Stack change: 0x110
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43ce3c
|
|
Stack change: 0x110
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43ce40
|
|
Stack change: 0x110
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43d72c
|
|
Stack change: 0x110
|
|
Changed registers: x27 x28 x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43d730
|
|
Stack change: 0x110
|
|
Changed registers: x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43d734
|
|
Stack change: 0x110
|
|
Changed registers: x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43e850
|
|
Stack change: 0x11233
|
|
Changed registers: x29 x30 x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x43e854
|
|
Stack change: 0x11233
|
|
Changed registers: x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x43e8f4
|
|
Stack change: 0x11233
|
|
Changed registers: x0 x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x21
|
|
Var Read: x12
|
|
|
|
Gadget 0x43ea9c
|
|
Stack change: 0x490
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43eaa0
|
|
Stack change: 0x490
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43eaa4
|
|
Stack change: 0x490
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43eaa8
|
|
Stack change: 0x490
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43f618
|
|
Stack change: 0x2e0
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43f61c
|
|
Stack change: 0x2e0
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43f620
|
|
Stack change: 0x2e0
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43f624
|
|
Stack change: 0x2e0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4422d0
|
|
Stack change: 0x10
|
|
Changed registers: x0 x1 sp
|
|
Register dependencies:
|
|
Memory Read: x0 Value: 0x7
|
|
Var Read: x1
|
|
Var Read: x0
|
|
|
|
Gadget 0x4422d4
|
|
Stack change: 0x10
|
|
Changed registers: x0 x1 sp
|
|
Register dependencies:
|
|
Var Read: x1
|
|
Var Read: x0
|
|
|
|
Gadget 0x4422d8
|
|
Stack change: 0x10
|
|
Changed registers: x0 x1 sp
|
|
Register dependencies:
|
|
Var Read: x1
|
|
Var Read: x0
|
|
|
|
Gadget 0x4422dc
|
|
Stack change: 0x10
|
|
Changed registers: x1 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4472f4
|
|
Stack change: 0x5f0
|
|
Changed registers: x21 x22 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4472f8
|
|
Stack change: 0x5f0
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4472fc
|
|
Stack change: 0x5f0
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x447300
|
|
Stack change: 0x5f0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4492dc
|
|
Stack change: 0x8280
|
|
Changed registers: x12 x21 x22 x23 x24 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4492e0
|
|
Stack change: 0x8280
|
|
Changed registers: x21 x22 x23 x24 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4492e4
|
|
Stack change: 0x8280
|
|
Changed registers: x23 x24 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x44bf40
|
|
Stack change: 0x20
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x44bf44
|
|
Stack change: 0x20
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x44bf48
|
|
Stack change: 0x20
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x44bf4c
|
|
Stack change: 0x20
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x450520
|
|
Stack change: 0x520
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x450524
|
|
Stack change: 0x520
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x450528
|
|
Stack change: 0x520
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x45052c
|
|
Stack change: 0x520
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x451ff4
|
|
Stack change: 0x260
|
|
Changed registers: x21 x22 x23 x24 x25 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x451ff8
|
|
Stack change: 0x260
|
|
Changed registers: x23 x24 x25 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x451ffc
|
|
Stack change: 0x260
|
|
Changed registers: x25 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x452000
|
|
Stack change: 0x260
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x45243c
|
|
Stack change: 0x260
|
|
Changed registers: x29 x30 x0 sp
|
|
Register dependencies:
|
|
Var Read: x3
|
|
|
|
Gadget 0x452440
|
|
Stack change: 0x260
|
|
Changed registers: x0 sp
|
|
Register dependencies:
|
|
Var Read: x3
|
|
|
|
Gadget 0x452848
|
|
Stack change: 0x450
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
Memory Write: x0 Initial Value: 0xffffffffffffffff New Value: 0x0
|
|
Memory Write: x1 Initial Value: 0xffffffffffffffff New Value: 0x0
|
|
|
|
Gadget 0x45284c
|
|
Stack change: 0x450
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
Memory Write: x0 Initial Value: 0x0 New Value: 0x0
|
|
Memory Write: x1 Initial Value: 0x0 New Value: 0x0
|
|
|
|
Gadget 0x452850
|
|
Stack change: 0x450
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Memory Write: x0 Initial Value: 0x0 New Value: 0x0
|
|
Memory Write: x1 Initial Value: 0x0 New Value: 0x0
|
|
|
|
Gadget 0x452854
|
|
Stack change: 0x450
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4538c0
|
|
Stack change: 0x6d0
|
|
Changed registers: x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
Memory Write: x21 Initial Value: 0xffffffffffffffff New Value: 0xffffffffffffffff
|
|
Memory Write: x19 Initial Value: 0xffffffffffffffff New Value: 0xffffffffffffffff
|
|
|
|
Gadget 0x4538c4
|
|
Stack change: 0x6d0
|
|
Changed registers: x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4538c8
|
|
Stack change: 0x6d0
|
|
Changed registers: x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4538cc
|
|
Stack change: 0x6d0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453b0c
|
|
Stack change: 0x6c0
|
|
Changed registers: x19 x20 x21 x22 x23 x24 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453b10
|
|
Stack change: 0x6c0
|
|
Changed registers: x21 x22 x23 x24 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453b14
|
|
Stack change: 0x6c0
|
|
Changed registers: x23 x24 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453b18
|
|
Stack change: 0x6c0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453c44
|
|
Stack change: 0x6d0
|
|
Changed registers: x21 x22 x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453c48
|
|
Stack change: 0x6d0
|
|
Changed registers: x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453c4c
|
|
Stack change: 0x6d0
|
|
Changed registers: x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453ec0
|
|
Stack change: 0xa70
|
|
Changed registers: x29 x30 x19 x20 x21 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453ec4
|
|
Stack change: 0xa70
|
|
Changed registers: x19 x20 x21 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453ec8
|
|
Stack change: 0xa70
|
|
Changed registers: x21 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453ecc
|
|
Stack change: 0xa70
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453ef4
|
|
Stack change: 0xa70
|
|
Changed registers: x0 x19 x20 x21 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x45400c
|
|
Stack change: 0xebf
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x4
|
|
|
|
Gadget 0x454010
|
|
Stack change: 0xebf
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x4
|
|
|
|
Gadget 0x454014
|
|
Stack change: 0xebf
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x4
|
|
|
|
Gadget 0x454148
|
|
Stack change: 0x84f
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x4
|
|
|
|
Gadget 0x45414c
|
|
Stack change: 0x84f
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x4
|
|
|
|
Gadget 0x454150
|
|
Stack change: 0x84f
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x4
|
|
|
|
Gadget 0x454450
|
|
Stack change: 0xae0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x454454
|
|
Stack change: 0xae0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x454458
|
|
Stack change: 0xae0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x45445c
|
|
Stack change: 0xae0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4570d4
|
|
Stack change: 0x2f73a
|
|
Changed registers: sp x29 x30
|
|
Register dependencies:
|
|
Memory Write: x30 Initial Value: 0xffffffffffffffff New Value: 0xffffffffffffffff
|
|
|
|
Gadget 0x4570d8
|
|
Stack change: 0x2f73a
|
|
Changed registers: sp x29 x30
|
|
Register dependencies:
|
|
Memory Write: x30 Initial Value: 0xffffffffffffffff New Value: 0xffffffffffffffff
|
|
|
|
Gadget 0x4570dc
|
|
Stack change: 0x2f75a
|
|
Changed registers: x29 x30 sp
|
|
Register dependencies:
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets given the detailed stack change (>=0x1)
|
|
FILE=bins/arm/elf/hello-linux-arm64
|
|
CMDS=<<EOF
|
|
/Rs ">=0x1"
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Gadget 0x401a1c
|
|
Stack change: 0x4b0
|
|
Changed registers: x21 x22 x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x401a20
|
|
Stack change: 0x4b0
|
|
Changed registers: x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x401a24
|
|
Stack change: 0x4b0
|
|
Changed registers: x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x401a28
|
|
Stack change: 0x4b0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x402438
|
|
Stack change: 0x970
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x40243c
|
|
Stack change: 0x970
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x402440
|
|
Stack change: 0x970
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x402444
|
|
Stack change: 0x970
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x403d94
|
|
Stack change: 0x600
|
|
Changed registers: x21 x22 x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x403d98
|
|
Stack change: 0x600
|
|
Changed registers: x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x403d9c
|
|
Stack change: 0x600
|
|
Changed registers: x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x403da0
|
|
Stack change: 0x600
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x405c5c
|
|
Stack change: 0x2180
|
|
Changed registers: x19 x20 x12 x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x405c60
|
|
Stack change: 0x2180
|
|
Changed registers: x12 x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x405c64
|
|
Stack change: 0x2180
|
|
Changed registers: x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x405c68
|
|
Stack change: 0x2180
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4098e8
|
|
Stack change: 0x2180
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4098ec
|
|
Stack change: 0x2180
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4098f0
|
|
Stack change: 0x2180
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x412714
|
|
Stack change: 0x460
|
|
Changed registers: x0 x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x20
|
|
|
|
Gadget 0x412718
|
|
Stack change: 0x460
|
|
Changed registers: x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x41271c
|
|
Stack change: 0x460
|
|
Changed registers: x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x412720
|
|
Stack change: 0x460
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4128f4
|
|
Stack change: 0x470
|
|
Changed registers: x19 x20 x21 x22 x25 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4128f8
|
|
Stack change: 0x470
|
|
Changed registers: x21 x22 x25 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4128fc
|
|
Stack change: 0x470
|
|
Changed registers: x25 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x412900
|
|
Stack change: 0x470
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4129a8
|
|
Stack change: 0x1030
|
|
Changed registers: x29 x30 x12 x19 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4129ac
|
|
Stack change: 0x1030
|
|
Changed registers: x12 x19 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4129b0
|
|
Stack change: 0x1030
|
|
Changed registers: x19 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x413234
|
|
Stack change: 0x470
|
|
Changed registers: x21 x22 x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x413238
|
|
Stack change: 0x470
|
|
Changed registers: x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x41323c
|
|
Stack change: 0x470
|
|
Changed registers: x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x421ecc
|
|
Stack change: 0xb0
|
|
Changed registers: x21 x22 x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x421ed0
|
|
Stack change: 0xb0
|
|
Changed registers: x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x421ed4
|
|
Stack change: 0xb0
|
|
Changed registers: x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x421ed8
|
|
Stack change: 0xb0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4236e8
|
|
Stack change: 0x250
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4236ec
|
|
Stack change: 0x250
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4236f0
|
|
Stack change: 0x250
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4236f4
|
|
Stack change: 0x250
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x423ee0
|
|
Stack change: 0xc0
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x423ee4
|
|
Stack change: 0xc0
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x423ee8
|
|
Stack change: 0xc0
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x423eec
|
|
Stack change: 0xc0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4249c4
|
|
Stack change: 0x7c0
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4249c8
|
|
Stack change: 0x7c0
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4249cc
|
|
Stack change: 0x7c0
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4249d0
|
|
Stack change: 0x7c0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x425aa8
|
|
Stack change: 0x4b0
|
|
Changed registers: x29 x30 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x425aac
|
|
Stack change: 0x4b0
|
|
Changed registers: x29 x30 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x434d0c
|
|
Stack change: 0x870
|
|
Changed registers: x23 x24 x25 x26 x27 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x434d10
|
|
Stack change: 0x870
|
|
Changed registers: x25 x26 x27 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x434d14
|
|
Stack change: 0x870
|
|
Changed registers: x27 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x434d18
|
|
Stack change: 0x870
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x435dc0
|
|
Stack change: 0x8a0
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x435dc4
|
|
Stack change: 0x8a0
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x435dc8
|
|
Stack change: 0x8a0
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x435dcc
|
|
Stack change: 0x8a0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43bfe4
|
|
Stack change: 0x420
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43bfe8
|
|
Stack change: 0x420
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43bfec
|
|
Stack change: 0x420
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43bff0
|
|
Stack change: 0x420
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43ce34
|
|
Stack change: 0x110
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43ce38
|
|
Stack change: 0x110
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43ce3c
|
|
Stack change: 0x110
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43ce40
|
|
Stack change: 0x110
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43d72c
|
|
Stack change: 0x110
|
|
Changed registers: x27 x28 x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43d730
|
|
Stack change: 0x110
|
|
Changed registers: x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43d734
|
|
Stack change: 0x110
|
|
Changed registers: x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43e850
|
|
Stack change: 0x11233
|
|
Changed registers: x29 x30 x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x43e854
|
|
Stack change: 0x11233
|
|
Changed registers: x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x43e8f4
|
|
Stack change: 0x11233
|
|
Changed registers: x0 x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
Var Read: x21
|
|
Var Read: x12
|
|
|
|
Gadget 0x43ea9c
|
|
Stack change: 0x490
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43eaa0
|
|
Stack change: 0x490
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43eaa4
|
|
Stack change: 0x490
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43eaa8
|
|
Stack change: 0x490
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43f618
|
|
Stack change: 0x2e0
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43f61c
|
|
Stack change: 0x2e0
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43f620
|
|
Stack change: 0x2e0
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x43f624
|
|
Stack change: 0x2e0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4422d0
|
|
Stack change: 0x10
|
|
Changed registers: x0 x1 sp
|
|
Register dependencies:
|
|
Memory Read: x0 Value: 0x7
|
|
Var Read: x1
|
|
Var Read: x0
|
|
|
|
Gadget 0x4422d4
|
|
Stack change: 0x10
|
|
Changed registers: x0 x1 sp
|
|
Register dependencies:
|
|
Var Read: x1
|
|
Var Read: x0
|
|
|
|
Gadget 0x4422d8
|
|
Stack change: 0x10
|
|
Changed registers: x0 x1 sp
|
|
Register dependencies:
|
|
Var Read: x1
|
|
Var Read: x0
|
|
|
|
Gadget 0x4422dc
|
|
Stack change: 0x10
|
|
Changed registers: x1 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4472f4
|
|
Stack change: 0x5f0
|
|
Changed registers: x21 x22 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4472f8
|
|
Stack change: 0x5f0
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4472fc
|
|
Stack change: 0x5f0
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x447300
|
|
Stack change: 0x5f0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4492dc
|
|
Stack change: 0x8280
|
|
Changed registers: x12 x21 x22 x23 x24 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4492e0
|
|
Stack change: 0x8280
|
|
Changed registers: x21 x22 x23 x24 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x4492e4
|
|
Stack change: 0x8280
|
|
Changed registers: x23 x24 sp
|
|
Register dependencies:
|
|
Var Read: x12
|
|
|
|
Gadget 0x44bf40
|
|
Stack change: 0x20
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x44bf44
|
|
Stack change: 0x20
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x44bf48
|
|
Stack change: 0x20
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x44bf4c
|
|
Stack change: 0x20
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x450520
|
|
Stack change: 0x520
|
|
Changed registers: x23 x24 x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x450524
|
|
Stack change: 0x520
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x450528
|
|
Stack change: 0x520
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x45052c
|
|
Stack change: 0x520
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x451ff4
|
|
Stack change: 0x260
|
|
Changed registers: x21 x22 x23 x24 x25 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x451ff8
|
|
Stack change: 0x260
|
|
Changed registers: x23 x24 x25 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x451ffc
|
|
Stack change: 0x260
|
|
Changed registers: x25 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x452000
|
|
Stack change: 0x260
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x45243c
|
|
Stack change: 0x260
|
|
Changed registers: x29 x30 x0 sp
|
|
Register dependencies:
|
|
Var Read: x3
|
|
|
|
Gadget 0x452440
|
|
Stack change: 0x260
|
|
Changed registers: x0 sp
|
|
Register dependencies:
|
|
Var Read: x3
|
|
|
|
Gadget 0x452848
|
|
Stack change: 0x450
|
|
Changed registers: x25 x26 x27 x28 sp
|
|
Register dependencies:
|
|
Memory Write: x0 Initial Value: 0xffffffffffffffff New Value: 0x0
|
|
Memory Write: x1 Initial Value: 0xffffffffffffffff New Value: 0x0
|
|
|
|
Gadget 0x45284c
|
|
Stack change: 0x450
|
|
Changed registers: x27 x28 sp
|
|
Register dependencies:
|
|
Memory Write: x0 Initial Value: 0x0 New Value: 0x0
|
|
Memory Write: x1 Initial Value: 0x0 New Value: 0x0
|
|
|
|
Gadget 0x452850
|
|
Stack change: 0x450
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Memory Write: x0 Initial Value: 0x0 New Value: 0x0
|
|
Memory Write: x1 Initial Value: 0x0 New Value: 0x0
|
|
|
|
Gadget 0x452854
|
|
Stack change: 0x450
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4538c0
|
|
Stack change: 0x6d0
|
|
Changed registers: x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
Memory Write: x21 Initial Value: 0xffffffffffffffff New Value: 0xffffffffffffffff
|
|
Memory Write: x19 Initial Value: 0xffffffffffffffff New Value: 0xffffffffffffffff
|
|
|
|
Gadget 0x4538c4
|
|
Stack change: 0x6d0
|
|
Changed registers: x19 x20 x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4538c8
|
|
Stack change: 0x6d0
|
|
Changed registers: x21 x22 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4538cc
|
|
Stack change: 0x6d0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453b0c
|
|
Stack change: 0x6c0
|
|
Changed registers: x19 x20 x21 x22 x23 x24 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453b10
|
|
Stack change: 0x6c0
|
|
Changed registers: x21 x22 x23 x24 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453b14
|
|
Stack change: 0x6c0
|
|
Changed registers: x23 x24 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453b18
|
|
Stack change: 0x6c0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453c44
|
|
Stack change: 0x6d0
|
|
Changed registers: x21 x22 x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453c48
|
|
Stack change: 0x6d0
|
|
Changed registers: x23 x24 x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453c4c
|
|
Stack change: 0x6d0
|
|
Changed registers: x25 x26 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453ec0
|
|
Stack change: 0xa70
|
|
Changed registers: x29 x30 x19 x20 x21 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453ec4
|
|
Stack change: 0xa70
|
|
Changed registers: x19 x20 x21 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453ec8
|
|
Stack change: 0xa70
|
|
Changed registers: x21 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453ecc
|
|
Stack change: 0xa70
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x453ef4
|
|
Stack change: 0xa70
|
|
Changed registers: x0 x19 x20 x21 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x45400c
|
|
Stack change: 0xebf
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x4
|
|
|
|
Gadget 0x454010
|
|
Stack change: 0xebf
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x4
|
|
|
|
Gadget 0x454014
|
|
Stack change: 0xebf
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x4
|
|
|
|
Gadget 0x454148
|
|
Stack change: 0x84f
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x4
|
|
|
|
Gadget 0x45414c
|
|
Stack change: 0x84f
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x4
|
|
|
|
Gadget 0x454150
|
|
Stack change: 0x84f
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
Var Read: x4
|
|
|
|
Gadget 0x454450
|
|
Stack change: 0xae0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x454454
|
|
Stack change: 0xae0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x454458
|
|
Stack change: 0xae0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x45445c
|
|
Stack change: 0xae0
|
|
Changed registers: sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x4570d4
|
|
Stack change: 0x2f73a
|
|
Changed registers: sp x29 x30
|
|
Register dependencies:
|
|
Memory Write: x30 Initial Value: 0xffffffffffffffff New Value: 0xffffffffffffffff
|
|
|
|
Gadget 0x4570d8
|
|
Stack change: 0x2f73a
|
|
Changed registers: sp x29 x30
|
|
Register dependencies:
|
|
Memory Write: x30 Initial Value: 0xffffffffffffffff New Value: 0xffffffffffffffff
|
|
|
|
Gadget 0x4570dc
|
|
Stack change: 0x2f75a
|
|
Changed registers: x29 x30 sp
|
|
Register dependencies:
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets given the detailed gadget size (=4)
|
|
FILE=bins/arm/crackme.arm32.bin
|
|
CMDS=<<EOF
|
|
e asm.arch=arm
|
|
e asm.bits=32
|
|
e cfg.bigendian=false
|
|
/Rl "=4"
|
|
echo "================================"
|
|
/R | grep -A 8 0x00000900
|
|
echo "================================"
|
|
/R | grep -A 8 0x00000934
|
|
echo "================================"
|
|
/R | grep -A 8 0x00000c10
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Gadget 0x900
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r3 r6 r8 r9 r11 r12 sp
|
|
Register dependencies:
|
|
Memory Read: r1 Value: 0x4
|
|
|
|
Gadget 0x934
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r3 r4 r5 r6 r8 r11 r12 sp
|
|
Register dependencies:
|
|
Memory Read: r1 Value: 0x80007ab
|
|
|
|
Gadget 0xc10
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1edc
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
================================
|
|
0x00000900 4bbbd1e9 ldmib r1, {r0, r1, r3, r6, r8, sb, fp, ip, sp, pc} ^
|
|
Gadget size: 4
|
|
|
|
0x00000904 022382fa blx 0xfe089514
|
|
Gadget size: 4
|
|
|
|
0x0000090c 0800a4fa blx 0xfe900934
|
|
Gadget size: 4
|
|
|
|
================================
|
|
0x00000934 7bb9d1e9 ldmib r1, {r0, r1, r3, r4, r5, r6, r8, fp, ip, sp, pc} ^
|
|
Gadget size: 4
|
|
|
|
0x0000093c 200182fa blx 0xfe080dc4
|
|
Gadget size: 4
|
|
|
|
0x00000950 8cf3002b blhs 0x3d788
|
|
Gadget size: 4
|
|
|
|
================================
|
|
0x00000c10 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 8
|
|
|
|
0x00000c10 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 4
|
|
|
|
0x00000c40 40f18380 addhi pc, r3, r0, asr 2
|
|
Gadget size: 4
|
|
|
|
0x00000c44 4745c346 strbmi r4, [r3], r7, asr 10
|
|
0x00000c48 c0f0ab80 adchi pc, fp, r0, asr 1
|
|
Gadget size: 8
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets given the detailed gadget size (<10)
|
|
FILE=bins/arm/crackme.arm32.bin
|
|
CMDS=<<EOF
|
|
e asm.arch=arm
|
|
e asm.bits=32
|
|
e cfg.bigendian=false
|
|
/Rl "<10"
|
|
echo "================================"
|
|
/R | grep -A 8 0x00000900
|
|
echo "================================"
|
|
/R | grep -A 8 0x00000934
|
|
echo "================================"
|
|
/R | grep -A 8 0x00000c0c
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Gadget 0x900
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r3 r6 r8 r9 r11 r12 sp
|
|
Register dependencies:
|
|
Memory Read: r1 Value: 0x4
|
|
|
|
Gadget 0x934
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r3 r4 r5 r6 r8 r11 r12 sp
|
|
Register dependencies:
|
|
Memory Read: r1 Value: 0x80007ab
|
|
|
|
Gadget 0xc0c
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0xc10
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d8
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1120
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1894
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed8
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1edc
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
================================
|
|
0x00000900 4bbbd1e9 ldmib r1, {r0, r1, r3, r6, r8, sb, fp, ip, sp, pc} ^
|
|
Gadget size: 4
|
|
|
|
0x00000904 022382fa blx 0xfe089514
|
|
Gadget size: 4
|
|
|
|
0x0000090c 0800a4fa blx 0xfe900934
|
|
Gadget size: 4
|
|
|
|
================================
|
|
0x00000934 7bb9d1e9 ldmib r1, {r0, r1, r3, r4, r5, r6, r8, fp, ip, sp, pc} ^
|
|
Gadget size: 4
|
|
|
|
0x0000093c 200182fa blx 0xfe080dc4
|
|
Gadget size: 4
|
|
|
|
0x00000950 8cf3002b blhs 0x3d788
|
|
Gadget size: 4
|
|
|
|
================================
|
|
0x00000c0c e7d10020 andhs sp, r0, r7, ror 3
|
|
0x00000c10 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 8
|
|
|
|
0x00000c10 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 4
|
|
|
|
0x00000c40 40f18380 addhi pc, r3, r0, asr 2
|
|
Gadget size: 4
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets given the detailed gadget size (<=10)
|
|
FILE=bins/arm/crackme.arm32.bin
|
|
CMDS=<<EOF
|
|
e asm.arch=arm
|
|
e asm.bits=32
|
|
e cfg.bigendian=false
|
|
/Rl "<=10"
|
|
echo "================================"
|
|
/R | grep -A 8 0x00000900
|
|
echo "================================"
|
|
/R | grep -A 8 0x000010d8
|
|
echo "================================"
|
|
/R | grep -A 8 0x00001edc
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Gadget 0x900
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r3 r6 r8 r9 r11 r12 sp
|
|
Register dependencies:
|
|
Memory Read: r1 Value: 0x4
|
|
|
|
Gadget 0x934
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r3 r4 r5 r6 r8 r11 r12 sp
|
|
Register dependencies:
|
|
Memory Read: r1 Value: 0x80007ab
|
|
|
|
Gadget 0xc0c
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0xc10
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d8
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1120
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1894
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed8
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1edc
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
================================
|
|
0x00000900 4bbbd1e9 ldmib r1, {r0, r1, r3, r6, r8, sb, fp, ip, sp, pc} ^
|
|
Gadget size: 4
|
|
|
|
0x00000904 022382fa blx 0xfe089514
|
|
Gadget size: 4
|
|
|
|
0x0000090c 0800a4fa blx 0xfe900934
|
|
Gadget size: 4
|
|
|
|
================================
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 20
|
|
|
|
0x000010d0 bde8f08f svchi 0xf0e8bd
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 16
|
|
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 12
|
|
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 8
|
|
|
|
0x00001118 01025a60 subsvs r0, sl, r1, lsl 4
|
|
0x0000111c 00f05efb blx 0x17bd126
|
|
Gadget size: 8
|
|
|
|
0x0000111c 00f05efb blx 0x17bd126
|
|
================================
|
|
0x00001edc 02b0bde8 pop {r1, ip, sp, pc}
|
|
Gadget size: 20
|
|
|
|
0x00001ed0 b1f90c00 strheq pc, [ip], -r1
|
|
0x00001ed4 08b902b0 andlt fp, r2, r8, lsl 18
|
|
0x00001ed8 10bd2046 qadd16mi fp, r0, r0
|
|
0x00001edc 02b0bde8 pop {r1, ip, sp, pc}
|
|
Gadget size: 16
|
|
|
|
0x00001ed4 08b902b0 andlt fp, r2, r8, lsl 18
|
|
0x00001ed8 10bd2046 qadd16mi fp, r0, r0
|
|
0x00001edc 02b0bde8 pop {r1, ip, sp, pc}
|
|
Gadget size: 12
|
|
|
|
0x00001ed8 10bd2046 qadd16mi fp, r0, r0
|
|
0x00001edc 02b0bde8 pop {r1, ip, sp, pc}
|
|
Gadget size: 8
|
|
|
|
0x00001edc 02b0bde8 pop {r1, ip, sp, pc}
|
|
Gadget size: 4
|
|
|
|
0x00001ee8 fef742fe mcr2 p7, 2, pc, c2, c14, 7
|
|
0x00001eec 0199efe7 strb sb, [pc, r1, lsl 18]!
|
|
0x00001ef0 20b1054b blmi 0x16e378
|
|
Gadget size: 12
|
|
|
|
0x00001eec 0199efe7 strb sb, [pc, r1, lsl 18]!
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets given the detailed gadget size (>10)
|
|
FILE=bins/arm/crackme.arm32.bin
|
|
CMDS=<<EOF
|
|
e asm.arch=arm
|
|
e asm.bits=32
|
|
e cfg.bigendian=false
|
|
/Rl ">10"
|
|
echo "================================"
|
|
/R | grep -A 8 0x000010cc
|
|
echo "================================"
|
|
/R | grep -A 8 0x000010d0
|
|
echo "================================"
|
|
/R | grep -A 8 0x000010d4
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Gadget 0x10cc
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d0
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d4
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1890
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ecc
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed0
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed4
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
================================
|
|
0x000010cc 204603b0 andlt r4, r3, r0, lsr 12
|
|
0x000010d0 bde8f08f svchi 0xf0e8bd
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 20
|
|
|
|
0x000010d0 bde8f08f svchi 0xf0e8bd
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
================================
|
|
0x000010d0 bde8f08f svchi 0xf0e8bd
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 20
|
|
|
|
0x000010d0 bde8f08f svchi 0xf0e8bd
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 16
|
|
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
================================
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 20
|
|
|
|
0x000010d0 bde8f08f svchi 0xf0e8bd
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 16
|
|
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 12
|
|
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 8
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets given the detailed gadget size (>=10)
|
|
FILE=bins/arm/crackme.arm32.bin
|
|
CMDS=<<EOF
|
|
e asm.arch=arm
|
|
e asm.bits=32
|
|
e cfg.bigendian=false
|
|
/Rl ">=10"
|
|
echo "================================"
|
|
/R | grep -A 8 0x000010cc
|
|
echo "================================"
|
|
/R | grep -A 8 0x000010d0
|
|
echo "================================"
|
|
/R | grep -A 8 0x000010d4
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Gadget 0x10cc
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d0
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x10d4
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1890
|
|
Stack change: 0x0
|
|
Changed registers: r0 r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ecc
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed0
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
Gadget 0x1ed4
|
|
Stack change: 0x0
|
|
Changed registers: r1 r12 sp
|
|
Register dependencies:
|
|
|
|
================================
|
|
0x000010cc 204603b0 andlt r4, r3, r0, lsr 12
|
|
0x000010d0 bde8f08f svchi 0xf0e8bd
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 20
|
|
|
|
0x000010d0 bde8f08f svchi 0xf0e8bd
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
================================
|
|
0x000010d0 bde8f08f svchi 0xf0e8bd
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 20
|
|
|
|
0x000010d0 bde8f08f svchi 0xf0e8bd
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 16
|
|
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
================================
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 20
|
|
|
|
0x000010d0 bde8f08f svchi 0xf0e8bd
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 16
|
|
|
|
0x000010d4 00240c23 movwhs r2, 0xc400
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 12
|
|
|
|
0x000010d8 20462b60 eorvs r4, fp, r0, lsr 12
|
|
0x000010dc 03b0bde8 pop {r0, r1, ip, sp, pc}
|
|
Gadget size: 8
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/Rk constraint filtering
|
|
FILE=bins/elf/analysis/x86-helloworld-phdr
|
|
ARGS=-n
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e asm.bits=32
|
|
/Rk eax=1
|
|
/Rk ecx=0
|
|
/Rk eax=1,ecx=0
|
|
echo "Expected no results for eax=0"
|
|
/Rk eax=0
|
|
echo "Testing MOV_OP_CONST"
|
|
/Rk eax+=1
|
|
echo "Testing MOV_OP_REG"
|
|
/Rk eax=ebx+ecx
|
|
/Rk invalidconstraint
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x000000b4 cd80 int 0x80
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 15
|
|
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 13
|
|
|
|
0x000000b4 cd80 int 0x80
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 15
|
|
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 13
|
|
|
|
0x000000b7 0100 add dword [eax], eax
|
|
0x000000b9 0000 add byte [eax], al
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 12
|
|
|
|
0x000000b9 0000 add byte [eax], al
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 10
|
|
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 8
|
|
|
|
0x000000b4 cd80 int 0x80
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 15
|
|
|
|
0x000000b6 b801000000 mov eax, 0x01
|
|
0x000000bb b900000000 mov ecx, 0x00
|
|
0x000000c0 cd80 int 0x80
|
|
0x000000c2 c3 ret
|
|
Gadget size: 13
|
|
|
|
Expected no results for eax=0
|
|
Testing MOV_OP_CONST
|
|
Testing MOV_OP_REG
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/Rgl test
|
|
FILE=bins/elf/crackme0x05
|
|
CMDS=<<EOF
|
|
aaa
|
|
/Rgl
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Gadget 0x8048275 (size 6 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048275 6f outsd | Stack change: 0x4
|
|
0x08048276 6e outsb | Modified regs: edi esp
|
|
0x08048277 5f pop edi | Dependencies: esp esp
|
|
0x08048278 7374 jnb 0x80482ee |
|
|
0x0804827a 61 popad |
|
|
|
|
Gadget 0x8048276 (size 5 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048276 6e outsb | Stack change: 0x4
|
|
0x08048277 5f pop edi | Modified regs: edi esp
|
|
0x08048278 7374 jnb 0x80482ee | Dependencies: esp esp
|
|
0x0804827a 61 popad |
|
|
|
|
Gadget 0x8048277 (size 4 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048277 5f pop edi | Stack change: 0x4
|
|
0x08048278 7374 jnb 0x80482ee | Modified regs: edi esp
|
|
0x0804827a 61 popad | Dependencies: esp esp
|
|
|
|
Gadget 0x8048278 (size 3 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048278 7374 jnb 0x80482ee | Stack change: 0x0
|
|
0x0804827a 61 popad | Modified regs:
|
|
|
|
Gadget 0x804827a (size 1 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804827a 61 popad | Stack change: 0x0
|
|
|
|
Gadget 0x8048292 (size 3 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048292 7363 jnb 0x80482f7 | Stack change: 0x0
|
|
0x08048294 61 popad | Modified regs:
|
|
|
|
Gadget 0x80482b0 (size 6 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080482b0 62635f bound esp, qword [ebx+0x5f] | Stack change: 0x0
|
|
0x080482b3 7374 jnb 0x8048329 | Modified regs:
|
|
0x080482b5 61 popad | Dependencies: ebx esp ebx
|
|
|
|
Gadget 0x80482af (size 12 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080482af 6962635f737461 imul esp, dword [edx+0x63], 0x6174735f | Stack change: 0x4
|
|
0x080482b6 7274 jb 0x804832c | Modified regs: esp edi
|
|
0x080482b8 5f pop edi | Dependencies: edx edx esp esp
|
|
0x080482b9 6d insd |
|
|
0x080482ba 61 popad |
|
|
|
|
Gadget 0x80482b4 (size 7 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080482b4 7461 jz 0x8048317 | Stack change: 0x4
|
|
0x080482b6 7274 jb 0x804832c | Modified regs: edi esp
|
|
0x080482b8 5f pop edi | Dependencies: esp esp
|
|
0x080482b9 6d insd |
|
|
0x080482ba 61 popad |
|
|
|
|
Gadget 0x80482b6 (size 5 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080482b6 7274 jb 0x804832c | Stack change: 0x4
|
|
0x080482b8 5f pop edi | Modified regs: edi esp
|
|
0x080482b9 6d insd | Dependencies: esp esp
|
|
0x080482ba 61 popad |
|
|
|
|
Gadget 0x80482b7 (size 4 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080482b7 745f jz 0x8048318 | Stack change: 0x0
|
|
0x080482b9 6d insd | Modified regs:
|
|
0x080482ba 61 popad | Dependencies:
|
|
|
|
Gadget 0x80482b8 (size 3 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080482b8 5f pop edi | Stack change: 0x4
|
|
0x080482b9 6d insd | Modified regs: edi esp
|
|
0x080482ba 61 popad | Dependencies: esp esp
|
|
|
|
Gadget 0x80482b9 (size 2 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080482b9 6d insd | Stack change: 0x0
|
|
0x080482ba 61 popad | Modified regs:
|
|
|
|
Gadget 0x8048349 (size 5 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048349 0100 add dword [eax], eax | Stack change: 0x0
|
|
0x0804834b 00e8 add al, ch | Modified regs: eax
|
|
0x0804834d cf iretd | Dependencies: eax eax eax eax ecx
|
|
|
|
Gadget 0x804834b (size 3 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804834b 00e8 add al, ch | Stack change: 0x0
|
|
0x0804834d cf iretd | Modified regs: eax
|
|
|
|
Gadget 0x804834d (size 1 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804834d cf iretd | Stack change: 0x0
|
|
|
|
Gadget 0x804834e (size 5 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804834e 0200 add al, byte [eax] | Stack change: 0x4
|
|
0x08048350 00c9 add cl, cl | Modified regs: eax ecx esp
|
|
0x08048352 c3 ret | Dependencies: eax eax eax ecx esp esp
|
|
|
|
Gadget 0x804834f (size 4 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804834f 0000 add byte [eax], al | Stack change: 0x8
|
|
0x08048351 c9 leave | Modified regs: esp ebp
|
|
0x08048352 c3 ret | Dependencies: eax eax eax ebp esp esp esp esp
|
|
|
|
Gadget 0x8048350 (size 3 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048350 00c9 add cl, cl | Stack change: 0x4
|
|
0x08048352 c3 ret | Modified regs: ecx esp
|
|
|
|
Gadget 0x8048351 (size 2 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048351 c9 leave | Stack change: 0xffffffff00000008
|
|
0x08048352 c3 ret | Modified regs: esp ebp
|
|
|
|
Gadget 0x8048352 (size 1 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048352 c3 ret | Stack change: 0x4
|
|
|
|
Gadget 0x80483fa (size 6 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080483fa 0000 add byte [eax], al | Stack change: 0x4
|
|
0x080483fc 005b81 add byte [ebx-0x7f], bl | Modified regs: esp
|
|
0x080483ff c3 ret | Dependencies: eax eax eax ebx ebx ebx esp esp
|
|
|
|
Gadget 0x80483fc (size 4 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080483fc 005b81 add byte [ebx-0x7f], bl | Stack change: 0x4
|
|
0x080483ff c3 ret | Modified regs: esp
|
|
|
|
Gadget 0x804840a (size 11 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804840a ff85c07402ff inc dword [ebp-0xfd8b40] | Stack change: 0xffffffff00000008
|
|
0x08048410 d0585b rcr byte [eax+0x5b], 0x01 | Modified regs: esp ebp
|
|
0x08048413 c9 leave | Dependencies: ebp ebp eax eax ebp esp esp esp esp
|
|
0x08048414 c3 ret |
|
|
|
|
Gadget 0x804840c (size 9 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804840c c07402ffd0 shl byte [edx+eax*1-0x01], 0xd0 | Stack change: 0xffffffff00000010
|
|
0x08048411 58 pop eax | Modified regs: eax esp ebx ebp
|
|
0x08048412 5b pop ebx | Dependencies: eax edx eax edx esp esp esp esp ebp esp esp esp esp
|
|
0x08048413 c9 leave |
|
|
0x08048414 c3 ret |
|
|
|
|
Gadget 0x804840e (size 7 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804840e 02ff add bh, bh | Stack change: 0xffffffff00000008
|
|
0x08048410 d0585b rcr byte [eax+0x5b], 0x01 | Modified regs: ebx esp ebp
|
|
0x08048413 c9 leave | Dependencies: ebx eax eax ebp esp esp esp esp
|
|
0x08048414 c3 ret |
|
|
|
|
Gadget 0x8048410 (size 5 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048410 d0585b rcr byte [eax+0x5b], 0x01 | Stack change: 0xffffffff00000008
|
|
0x08048413 c9 leave | Modified regs: esp ebp
|
|
0x08048414 c3 ret | Dependencies: eax eax ebp esp esp esp esp
|
|
|
|
Gadget 0x8048411 (size 4 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048411 58 pop eax | Stack change: 0xffffffff00000010
|
|
0x08048412 5b pop ebx | Modified regs: eax esp ebx ebp
|
|
0x08048413 c9 leave | Dependencies: esp esp esp esp ebp esp esp esp esp
|
|
0x08048414 c3 ret |
|
|
|
|
Gadget 0x8048412 (size 3 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048412 5b pop ebx | Stack change: 0xffffffff0000000c
|
|
0x08048413 c9 leave | Modified regs: ebx esp ebp
|
|
0x08048414 c3 ret | Dependencies: esp esp ebp esp esp esp esp
|
|
|
|
Gadget 0x8048441 (size 14 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048441 1085d275ebc6 adc byte [ebp-0x39148a2e], al | Stack change: 0x4
|
|
0x08048447 0524a00408 add eax, 0x804a024 | Modified regs: eax ecx esp
|
|
0x0804844c 01c9 add ecx, ecx | Dependencies: ebp ebp eax eax ecx esp esp
|
|
0x0804844e c3 ret |
|
|
|
|
Gadget 0x8048442 (size 13 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048442 85d2 test edx, edx | Stack change: 0xffffffff00000008
|
|
0x08048444 75eb jnz 0x8048431 | Modified regs: esp ebp
|
|
0x08048446 c60524a0040801 mov byte [0x804a024], 0x01 | Dependencies: ebp esp esp esp esp
|
|
0x0804844d c9 leave |
|
|
0x0804844e c3 ret |
|
|
|
|
Gadget 0x8048443 (size 12 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048443 d275eb shl byte [ebp-0x15], cl | Stack change: 0xffffffff00000008
|
|
0x08048446 c60524a0040801 mov byte [0x804a024], 0x01 | Modified regs: esp ebp
|
|
0x0804844d c9 leave | Dependencies: ebp ebp ecx ebp esp esp esp esp
|
|
0x0804844e c3 ret |
|
|
|
|
Gadget 0x8048444 (size 11 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048444 75eb jnz 0x8048431 | Stack change: 0xffffffff00000008
|
|
0x08048446 c60524a0040801 mov byte [0x804a024], 0x01 | Modified regs: esp ebp
|
|
0x0804844d c9 leave | Dependencies: ebp esp esp esp esp
|
|
0x0804844e c3 ret |
|
|
|
|
Gadget 0x8048446 (size 9 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048446 c60524a0040801 mov byte [0x804a024], 0x01 | Stack change: 0xffffffff00000008
|
|
0x0804844d c9 leave | Modified regs: esp ebp
|
|
0x0804844e c3 ret | Dependencies: ebp esp esp esp esp
|
|
|
|
Gadget 0x8048447 (size 8 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048447 0524a00408 add eax, 0x804a024 | Stack change: 0x4
|
|
0x0804844c 01c9 add ecx, ecx | Modified regs: eax ecx esp
|
|
0x0804844e c3 ret | Dependencies: eax ecx esp esp
|
|
|
|
Gadget 0x8048448 (size 7 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048448 24a0 and al, 0xa0 | Stack change: 0x4
|
|
0x0804844a 0408 add al, 0x08 | Modified regs: eax ecx esp
|
|
0x0804844c 01c9 add ecx, ecx | Dependencies: eax eax eax ecx esp esp
|
|
0x0804844e c3 ret |
|
|
|
|
Gadget 0x8048449 (size 6 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048449 a0040801c9 mov al, byte [0xc9010804] | Stack change: 0x4
|
|
0x0804844e c3 ret | Modified regs: eax esp
|
|
|
|
Gadget 0x804844a (size 5 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804844a 0408 add al, 0x08 | Stack change: 0x4
|
|
0x0804844c 01c9 add ecx, ecx | Modified regs: eax ecx esp
|
|
0x0804844e c3 ret | Dependencies: eax ecx esp esp
|
|
|
|
Gadget 0x804844b (size 4 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804844b 0801 or byte [ecx], al | Stack change: 0xffffffff00000008
|
|
0x0804844d c9 leave | Modified regs: esp ebp
|
|
0x0804844e c3 ret | Dependencies: ecx ecx eax ebp esp esp esp esp
|
|
|
|
Gadget 0x804844c (size 3 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804844c 01c9 add ecx, ecx | Stack change: 0x4
|
|
0x0804844e c3 ret | Modified regs: ecx esp
|
|
|
|
Gadget 0x8048471 (size 17 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048471 7bfb jnp 0x804846e | Stack change: 0x4
|
|
0x08048473 f78db6000000008dbf00 test dword [ebp+0xb6], 0xbf8d00 | Modified regs: ecx esp
|
|
0x0804847d 0000 add byte [eax], al | Dependencies: ebp eax eax eax ecx esp esp
|
|
0x0804847f 00c9 add cl, cl |
|
|
0x08048481 c3 ret |
|
|
|
|
Gadget 0x8048472 (size 16 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048472 fb sti | Stack change: 0x4
|
|
0x08048473 f78db6000000008dbf00 test dword [ebp+0xb6], 0xbf8d00 | Modified regs: ecx esp
|
|
0x0804847d 0000 add byte [eax], al | Dependencies: ebp eax eax eax ecx esp esp
|
|
0x0804847f 00c9 add cl, cl |
|
|
0x08048481 c3 ret |
|
|
|
|
Gadget 0x8048473 (size 15 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048473 f78db6000000008dbf00 test dword [ebp+0xb6], 0xbf8d00 | Stack change: 0x4
|
|
0x0804847d 0000 add byte [eax], al | Modified regs: ecx esp
|
|
0x0804847f 00c9 add cl, cl | Dependencies: ebp eax eax eax ecx esp esp
|
|
0x08048481 c3 ret |
|
|
|
|
Gadget 0x8048474 (size 14 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048474 8db600000000 lea esi, dword [esi] | Stack change: 0xffffffff00000008
|
|
0x0804847a 8dbf00000000 lea edi, dword [edi] | Modified regs: esi edi esp ebp
|
|
0x08048480 c9 leave | Dependencies: esi edi ebp esp esp esp esp
|
|
0x08048481 c3 ret |
|
|
|
|
Gadget 0x8048475 (size 13 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048475 b600 mov dh, 0x00 | Stack change: 0x4
|
|
0x08048477 0000 add byte [eax], al | Modified regs: edx ecx esp
|
|
0x08048479 008dbf000000 add byte [ebp+0xbf], cl | Dependencies: edx eax eax eax ebp ebp ecx ecx esp esp
|
|
0x0804847f 00c9 add cl, cl |
|
|
0x08048481 c3 ret |
|
|
|
|
Gadget 0x8048476 (size 12 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048476 0000 add byte [eax], al | Stack change: 0xffffffff00000008
|
|
0x08048478 0000 add byte [eax], al | Modified regs: edi esp ebp
|
|
0x0804847a 8dbf00000000 lea edi, dword [edi] | Dependencies: eax eax eax eax eax eax edi ebp esp esp esp esp
|
|
0x08048480 c9 leave |
|
|
0x08048481 c3 ret |
|
|
|
|
Gadget 0x8048477 (size 11 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048477 0000 add byte [eax], al | Stack change: 0x4
|
|
0x08048479 008dbf000000 add byte [ebp+0xbf], cl | Modified regs: ecx esp
|
|
0x0804847f 00c9 add cl, cl | Dependencies: eax eax eax ebp ebp ecx ecx esp esp
|
|
0x08048481 c3 ret |
|
|
|
|
Gadget 0x8048478 (size 10 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048478 0000 add byte [eax], al | Stack change: 0xffffffff00000008
|
|
0x0804847a 8dbf00000000 lea edi, dword [edi] | Modified regs: edi esp ebp
|
|
0x08048480 c9 leave | Dependencies: eax eax eax edi ebp esp esp esp esp
|
|
0x08048481 c3 ret |
|
|
|
|
Gadget 0x8048479 (size 9 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048479 008dbf000000 add byte [ebp+0xbf], cl | Stack change: 0x4
|
|
0x0804847f 00c9 add cl, cl | Modified regs: ecx esp
|
|
0x08048481 c3 ret | Dependencies: ebp ebp ecx ecx esp esp
|
|
|
|
Gadget 0x804847a (size 8 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804847a 8dbf00000000 lea edi, dword [edi] | Stack change: 0xffffffff00000008
|
|
0x08048480 c9 leave | Modified regs: edi esp ebp
|
|
0x08048481 c3 ret | Dependencies: edi ebp esp esp esp esp
|
|
|
|
Gadget 0x804847b (size 7 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804847b bf00000000 mov edi, 0x00 | Stack change: 0xffffffff00000008
|
|
0x08048480 c9 leave | Modified regs: edi esp ebp
|
|
0x08048481 c3 ret | Dependencies: ebp esp esp esp esp
|
|
|
|
Gadget 0x804847c (size 6 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804847c 0000 add byte [eax], al | Stack change: 0xffffffff00000008
|
|
0x0804847e 0000 add byte [eax], al | Modified regs: esp ebp
|
|
0x08048480 c9 leave | Dependencies: eax eax eax eax eax eax ebp esp esp esp esp
|
|
0x08048481 c3 ret |
|
|
|
|
Gadget 0x804847d (size 5 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804847d 0000 add byte [eax], al | Stack change: 0x4
|
|
0x0804847f 00c9 add cl, cl | Modified regs: ecx esp
|
|
0x08048481 c3 ret | Dependencies: eax eax eax ecx esp esp
|
|
|
|
Gadget 0x80484c5 (size 3 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080484c5 ffc9 dec ecx | Stack change: 0x4
|
|
0x080484c7 c3 ret | Modified regs: ecx esp
|
|
|
|
Gadget 0x8048595 (size 7 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048595 b800000000 mov eax, 0x00 | Stack change: 0xffffffff00000008
|
|
0x0804859a c9 leave | Modified regs: eax esp ebp
|
|
0x0804859b c3 ret | Dependencies: ebp esp esp esp esp
|
|
|
|
Gadget 0x80485a6 (size 9 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080485a6 f653e8 not byte [ebx-0x18] | Stack change: 0x4
|
|
0x080485a9 6800000081 push 0x81000000 | Modified regs: esp
|
|
0x080485ae c3 ret | Dependencies: ebx ebx esp esp esp
|
|
|
|
Gadget 0x80485a9 (size 6 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080485a9 6800000081 push 0x81000000 | Stack change: 0x4
|
|
0x080485ae c3 ret | Modified regs: esp
|
|
|
|
Gadget 0x80485fa (size 9 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080485fa da83c41c5b5e fiadd dword [ebx+0x5e5b1cc4] | Stack change: 0xffffffff0000000c
|
|
0x08048600 5f pop edi | Modified regs: edi esp ebp
|
|
0x08048601 c9 leave | Dependencies: esp esp ebp esp esp esp esp
|
|
0x08048602 c3 ret |
|
|
|
|
Gadget 0x80485fc (size 7 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080485fc c41c5b les ebx, fword [ebx+ebx*2] | Stack change: 0x10
|
|
0x080485ff 5e pop esi | Modified regs: ebx esi esp edi ebp
|
|
0x08048600 5f pop edi | Dependencies: ebx esp esp esp esp ebp esp esp esp esp
|
|
0x08048601 c9 leave |
|
|
0x08048602 c3 ret |
|
|
|
|
Gadget 0x80485fd (size 6 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080485fd 1c5b sbb al, 0x5b | Stack change: 0xffffffff00000010
|
|
0x080485ff 5e pop esi | Modified regs: eax esi esp edi ebp
|
|
0x08048600 5f pop edi | Dependencies: eax esp esp esp esp ebp esp esp esp esp
|
|
0x08048601 c9 leave |
|
|
0x08048602 c3 ret |
|
|
|
|
Gadget 0x80485fe (size 5 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080485fe 5b pop ebx | Stack change: 0x14
|
|
0x080485ff 5e pop esi | Modified regs: ebx esp esi edi ebp
|
|
0x08048600 5f pop edi | Dependencies: esp esp esp esp esp esp ebp esp esp esp esp
|
|
0x08048601 c9 leave |
|
|
0x08048602 c3 ret |
|
|
|
|
Gadget 0x80485ff (size 4 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x080485ff 5e pop esi | Stack change: 0xffffffff00000010
|
|
0x08048600 5f pop edi | Modified regs: esi esp edi ebp
|
|
0x08048601 c9 leave | Dependencies: esp esp esp esp ebp esp esp esp esp
|
|
0x08048602 c3 ret |
|
|
|
|
Gadget 0x8048600 (size 3 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048600 5f pop edi | Stack change: 0xc
|
|
0x08048601 c9 leave | Modified regs: edi esp ebp
|
|
0x08048602 c3 ret | Dependencies: esp esp ebp esp esp esp esp
|
|
|
|
Gadget 0x8048609 (size 12 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048609 8dbc2700000000 lea edi, dword [edi] | Stack change: 0xffffffff8100000d
|
|
0x08048610 55 push ebp | Modified regs: edi esp ebp
|
|
0x08048611 89e5 mov ebp, esp | Dependencies: edi ebp esp esp ebp esp esp esp esp
|
|
0x08048613 c9 leave |
|
|
0x08048614 c3 ret |
|
|
|
|
Gadget 0x804860a (size 11 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804860a bc27000000 mov esp, 0x27 | Stack change: 0x4
|
|
0x0804860f 005589 add byte [ebp-0x77], dl | Modified regs: esp
|
|
0x08048612 e5c9 in eax, 0xc9 | Dependencies: ebp ebp edx esp esp
|
|
0x08048614 c3 ret |
|
|
|
|
Gadget 0x804860d (size 8 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804860d 0000 add byte [eax], al | Stack change: 0x4
|
|
0x0804860f 005589 add byte [ebp-0x77], dl | Modified regs: esp
|
|
0x08048612 e5c9 in eax, 0xc9 | Dependencies: eax eax eax ebp ebp edx esp esp
|
|
0x08048614 c3 ret |
|
|
|
|
Gadget 0x804860e (size 7 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804860e 0000 add byte [eax], al | Stack change: 0xffffffff00000034
|
|
0x08048610 55 push ebp | Modified regs: esp ebp
|
|
0x08048611 89e5 mov ebp, esp | Dependencies: eax eax eax ebp esp esp ebp esp esp esp esp
|
|
0x08048613 c9 leave |
|
|
0x08048614 c3 ret |
|
|
|
|
Gadget 0x804860f (size 6 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804860f 005589 add byte [ebp-0x77], dl | Stack change: 0x4
|
|
0x08048612 e5c9 in eax, 0xc9 | Modified regs: esp
|
|
0x08048614 c3 ret | Dependencies: ebp ebp edx esp esp
|
|
|
|
Gadget 0x8048610 (size 5 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048610 55 push ebp | Stack change: 0xffffffff0000003c
|
|
0x08048611 89e5 mov ebp, esp | Modified regs: esp ebp
|
|
0x08048613 c9 leave | Dependencies: ebp esp esp ebp esp esp esp esp
|
|
0x08048614 c3 ret |
|
|
|
|
Gadget 0x8048611 (size 4 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048611 89e5 mov ebp, esp | Stack change: 0xffffffff00000044
|
|
0x08048613 c9 leave | Modified regs: ebp esp
|
|
0x08048614 c3 ret | Dependencies: esp ebp esp esp esp esp
|
|
|
|
Gadget 0x8048612 (size 3 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048612 e5c9 in eax, 0xc9 | Stack change: 0x4
|
|
0x08048614 c3 ret | Modified regs: esp
|
|
|
|
Gadget 0x8048615 (size 4 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048615 8b1c24 mov ebx, dword [esp] | Stack change: 0x4
|
|
0x08048618 c3 ret | Modified regs: ebx esp
|
|
|
|
Gadget 0x8048616 (size 3 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048616 1c24 sbb al, 0x24 | Stack change: 0x4
|
|
0x08048618 c3 ret | Modified regs: eax esp
|
|
|
|
Gadget 0x8048639 (size 10 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048639 0383f8ff75f4 add eax, dword [ebx-0xb8a0008] | Stack change: 0x10
|
|
0x0804863f 58 pop eax | Modified regs: eax esp ebx ebp
|
|
0x08048640 5b pop ebx | Dependencies: ebx eax esp esp esp esp esp esp esp esp
|
|
0x08048641 5d pop ebp |
|
|
0x08048642 c3 ret |
|
|
|
|
Gadget 0x804863c (size 7 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804863c ff75f4 push dword [ebp-0x0c] | Stack change: 0x10
|
|
0x0804863f 58 pop eax | Modified regs: esp eax ebx ebp
|
|
0x08048640 5b pop ebx | Dependencies: ebp esp esp esp esp esp esp esp esp esp
|
|
0x08048641 5d pop ebp |
|
|
0x08048642 c3 ret |
|
|
|
|
Gadget 0x804863d (size 6 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804863d 75f4 jnz 0x8048633 | Stack change: 0x10
|
|
0x0804863f 58 pop eax | Modified regs: eax esp ebx ebp
|
|
0x08048640 5b pop ebx | Dependencies: esp esp esp esp esp esp esp esp
|
|
0x08048641 5d pop ebp |
|
|
0x08048642 c3 ret |
|
|
|
|
Gadget 0x804863f (size 4 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804863f 58 pop eax | Stack change: 0x10
|
|
0x08048640 5b pop ebx | Modified regs: eax esp ebx ebp
|
|
0x08048641 5d pop ebp | Dependencies: esp esp esp esp esp esp esp esp
|
|
0x08048642 c3 ret |
|
|
|
|
Gadget 0x8048640 (size 3 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048640 5b pop ebx | Stack change: 0xc
|
|
0x08048641 5d pop ebp | Modified regs: ebx esp ebp
|
|
0x08048642 c3 ret | Dependencies: esp esp esp esp esp esp
|
|
|
|
Gadget 0x8048641 (size 2 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048641 5d pop ebp | Stack change: 0x8
|
|
0x08048642 c3 ret | Modified regs: ebp esp
|
|
|
|
Gadget 0x804865a (size 4 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804865a 59 pop ecx | Stack change: 0xffffffff00000010
|
|
0x0804865b 5b pop ebx | Modified regs: ecx esp ebx ebp
|
|
0x0804865c c9 leave | Dependencies: esp esp esp esp ebp esp esp esp esp
|
|
0x0804865d c3 ret |
|
|
|
|
Gadget 0x804866b (size 2 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804866b 50 push eax | Stack change: 0x0
|
|
0x0804866c 61 popad | Modified regs: esp
|
|
|
|
Gadget 0x8048677 (size 4 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048677 0a00 or al, byte [eax] | Stack change: 0x0
|
|
0x08048679 50 push eax | Modified regs: eax esp
|
|
0x0804867a 61 popad | Dependencies: eax eax eax eax esp
|
|
|
|
Gadget 0x804868d (size 9 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804868d 00494f add byte [ecx+0x4f], cl | Stack change: 0xffffffffffffffff
|
|
0x08048690 4c dec esp | Modified regs: esp ecx
|
|
0x08048691 49 dec ecx | Dependencies: ecx ecx ecx esp ecx ebx ebx eax
|
|
0x08048692 204372 and byte [ebx+0x72], al |
|
|
0x08048695 61 popad |
|
|
|
|
Gadget 0x804868f (size 7 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x0804868f 4f dec edi | Stack change: 0xffffffffffffffff
|
|
0x08048690 4c dec esp | Modified regs: edi esp ecx
|
|
0x08048691 49 dec ecx | Dependencies: edi esp ecx ebx ebx eax
|
|
0x08048692 204372 and byte [ebx+0x72], al |
|
|
0x08048695 61 popad |
|
|
|
|
Gadget 0x8048690 (size 6 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048690 4c dec esp | Stack change: 0xffffffffffffffff
|
|
0x08048691 49 dec ecx | Modified regs: esp ecx
|
|
0x08048692 204372 and byte [ebx+0x72], al | Dependencies: esp ecx ebx ebx eax
|
|
0x08048695 61 popad |
|
|
|
|
Gadget 0x8048691 (size 5 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048691 49 dec ecx | Stack change: 0x0
|
|
0x08048692 204372 and byte [ebx+0x72], al | Modified regs: ecx
|
|
0x08048695 61 popad | Dependencies: ecx ebx ebx eax
|
|
|
|
Gadget 0x8048692 (size 4 bytes)
|
|
------------------------------------------------------------------------------------------------------
|
|
0x08048692 204372 and byte [ebx+0x72], al | Stack change: 0x0
|
|
0x08048695 61 popad | Modified regs:
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=subchains test
|
|
FILE==
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e asm.bits=64
|
|
wa "pop r12; pop r13; pop r14; pop r15; ret"
|
|
e gadget.subchains=false
|
|
/Rq
|
|
echo "===================================================="
|
|
e gadget.subchains=true
|
|
/Rq
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000: pop r12; pop r13; pop r14; pop r15; ret;
|
|
0x00000001: pop rsp; pop r13; pop r14; pop r15; ret;
|
|
0x00000002: pop r13; pop r14; pop r15; ret;
|
|
0x00000003: pop rbp; pop r14; pop r15; ret;
|
|
0x00000004: pop r14; pop r15; ret;
|
|
0x00000005: pop rsi; pop r15; ret;
|
|
0x00000006: pop r15; ret;
|
|
0x00000007: pop rdi; ret;
|
|
0x00000008: ret;
|
|
====================================================
|
|
0x00000000: pop r12; pop r13; pop r14; pop r15; ret;
|
|
0x00000002: pop r13; pop r14; pop r15; ret;
|
|
0x00000004: pop r14; pop r15; ret;
|
|
0x00000006: pop r15; ret;
|
|
0x00000001: pop rsp; pop r13; pop r14; pop r15; ret;
|
|
0x00000002: pop r13; pop r14; pop r15; ret;
|
|
0x00000004: pop r14; pop r15; ret;
|
|
0x00000006: pop r15; ret;
|
|
0x00000002: pop r13; pop r14; pop r15; ret;
|
|
0x00000004: pop r14; pop r15; ret;
|
|
0x00000006: pop r15; ret;
|
|
0x00000003: pop rbp; pop r14; pop r15; ret;
|
|
0x00000004: pop r14; pop r15; ret;
|
|
0x00000006: pop r15; ret;
|
|
0x00000004: pop r14; pop r15; ret;
|
|
0x00000006: pop r15; ret;
|
|
0x00000005: pop rsi; pop r15; ret;
|
|
0x00000006: pop r15; ret;
|
|
0x00000006: pop r15; ret;
|
|
0x00000007: pop rdi; ret;
|
|
0x00000008: ret;
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search rop gadgets with comments
|
|
FILE==
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e asm.bits=64
|
|
wa "pop r12; ret"
|
|
CC Rizin is Cool! @ 0
|
|
CC Its elegant! @ 2
|
|
/R
|
|
echo "========================================================="
|
|
e gadget.comments=true
|
|
/R
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 415c pop r12
|
|
0x00000002 c3 ret
|
|
Gadget size: 3
|
|
|
|
0x00000001 5c pop rsp
|
|
0x00000002 c3 ret
|
|
Gadget size: 2
|
|
|
|
0x00000002 c3 ret
|
|
Gadget size: 1
|
|
|
|
=========================================================
|
|
0x00000000 415c pop r12 ; Rizin is Cool!
|
|
0x00000002 c3 ret ; Its elegant!
|
|
Gadget size: 3
|
|
|
|
0x00000001 5c pop rsp
|
|
0x00000002 c3 ret ; Its elegant!
|
|
Gadget size: 2
|
|
|
|
0x00000002 c3 ret ; Its elegant!
|
|
Gadget size: 1
|
|
|
|
EOF
|
|
RUN |