Closed agix closed 8 years ago
Indeed you are right -- I did a bit of debugging this afternoon, and BeaEngine actually sees the LockPrefix:
[image: Images intégrées 1]
It considers it as "InvalidPrefix" (http://www.beaengine.org/prefstruct) though for some reasons. I guess I'll have to dig BeaEngine to try and fix that then.
Cheers, 0vercl0k
2015-03-07 6:13 GMT-08:00 agix notifications@github.com:
When looking for gadgets, lock prefixed instructions are not filtered (or even marked).
SIGILL occurs then, breaking the ropchain.
python -c 'import sys; sys.stdout.write("f04889cec3".decode("hex"))' > bin ndisasm -b64 bin 00000000 F04889CE lock mov rsi,rcx 00000004 C3 ret rp-lin-x64 --raw=x64 -f bin -r 1 0x00000000: mov rsi, rcx ; ret ; (1 found)
— Reply to this email directly or view it on GitHub https://github.com/0vercl0k/rp/issues/6.
As Beatrix seems to be back from the dead and fairly actively working on BeaEngine5, I've filed this issue: https://github.com/BeaEngine/beaengine/issues/9 ; hopefully we'll finally have this fixed.
Cheers
PS D:\Codes\rp++\bin\Debug> .\rp-win-x64.exe --file D:\agix.bin --rop=3 --raw=x64
Trying to open 'D:\agix.bin'..
FileFormat: raw, Arch: x64
Wait a few seconds, rp++ is looking for gadgets (2 threads max)..
A total of 4 gadgets found.
0x00000004: ret ; \xc3 (1 found)
0x00000000: lock mov rsi, rcx ; ret ; \xf0\x48\x89\xce\xc3 (1 found)
0x00000001: mov rsi, rcx ; ret ; \x48\x89\xce\xc3 (1 found)
0x00000002: mov esi, ecx ; ret ; \x89\xce\xc3 (1 found)
I'm closing this now, feel free to re-open if you find other instances of this issue.
Cheers
When looking for gadgets, lock prefixed instructions are not filtered (or even marked).
SIGILL occurs then, breaking the ropchain.