search

0vercl0k / rp

rp++ is a fast C++ ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM/ARM64 binaries.
MIT License
1.78k stars 251 forks source link

lock instructions should be banned #6

Closed agix closed 8 years ago

agix commented 9 years ago

When looking for gadgets, lock prefixed instructions are not filtered (or even marked).

SIGILL occurs then, breaking the ropchain.

python -c 'import sys; sys.stdout.write("f04889cec3".decode("hex"))' > bin
ndisasm -b64 bin
00000000  F04889CE          lock mov rsi,rcx
00000004  C3                ret
rp-lin-x64 --raw=x64 -f bin -r 1
0x00000000: mov rsi, rcx ; ret  ;  (1 found)
0vercl0k commented 9 years ago

Indeed you are right -- I did a bit of debugging this afternoon, and BeaEngine actually sees the LockPrefix:

[image: Images intégrées 1]

It considers it as "InvalidPrefix" (http://www.beaengine.org/prefstruct) though for some reasons. I guess I'll have to dig BeaEngine to try and fix that then.

Cheers, 0vercl0k

2015-03-07 6:13 GMT-08:00 agix notifications@github.com:

When looking for gadgets, lock prefixed instructions are not filtered (or even marked).

SIGILL occurs then, breaking the ropchain.

python -c 'import sys; sys.stdout.write("f04889cec3".decode("hex"))' > bin ndisasm -b64 bin 00000000 F04889CE lock mov rsi,rcx 00000004 C3 ret rp-lin-x64 --raw=x64 -f bin -r 1 0x00000000: mov rsi, rcx ; ret ; (1 found)

— Reply to this email directly or view it on GitHub https://github.com/0vercl0k/rp/issues/6.

0vercl0k commented 8 years ago

As Beatrix seems to be back from the dead and fairly actively working on BeaEngine5, I've filed this issue: https://github.com/BeaEngine/beaengine/issues/9 ; hopefully we'll finally have this fixed.

Cheers

0vercl0k commented 8 years ago 
PS D:\Codes\rp++\bin\Debug> .\rp-win-x64.exe --file D:\agix.bin --rop=3 --raw=x64
Trying to open 'D:\agix.bin'..
FileFormat: raw, Arch: x64

Wait a few seconds, rp++ is looking for gadgets (2 threads max)..
A total of 4 gadgets found.
0x00000004: ret  ;  \xc3 (1 found)
0x00000000: lock mov rsi, rcx ; ret  ;  \xf0\x48\x89\xce\xc3 (1 found)
0x00000001: mov rsi, rcx ; ret  ;  \x48\x89\xce\xc3 (1 found)
0x00000002: mov esi, ecx ; ret  ;  \x89\xce\xc3 (1 found)

I'm closing this now, feel free to re-open if you find other instances of this issue.

Cheers