search

Boyan-MILANOV / ropium

ROPium is a tool that helps you building ROP exploits by finding and chaining gadgets together
350 stars 40 forks source link

TypeError @Conditions.py:344 #10

Closed Blyska closed 5 years ago

Blyska commented 5 years ago

Hi Boyan,

First of all, thanks for the tool, keep up the good work ;)

Python throws a TypeError when trying to load a kernel executable. Arch: x86, 32bits

Temporarily fixed the issue by adding a pair of None-checks @Condition.py:394. Not sure if it's semantically reliable in any way though.

Cheers, Blyska

"Crashdump"

Logged from file x86translator.py, line 243 % |████████████ | 042%Traceback (most recent call last): [...] File "[...]/scripts/ROPGenerator", line 5, in    Main.main() File "[...]/Main.py", line 66, in main    load(args[1:]) File "[...]/Load.py", line 193, in load    build(gadgetList) File "[...]/Database.py", line 553, in build    gadget = Gadget([addr], raw) File "[...]/Gadget.py", line 75, in init    self.semantics = self.graph.getSemantics() File "[...]/Graph.py", line 128, in getSemantics    semantics.simplifyConditions() File "[...]/Semantics.py", line 239, in simplifyConditions    if( p.cond.isTrue()):
File "[...]/Conditions.py", line 460, in isTrue     res = self.customSimplify() File "[...]/Conditions.py", line 398, in customSimplify    res = simplifyArrayEquality( leftArray, rightArray, self.cond) File "[...]/Conditions.py", line 344, in simplifyArrayEquality    for i in range(0,len(a1)): TypeError: object of type 'NoneType' has no len()

Boyan-MILANOV commented 5 years ago

Hey !

First of all thanks for the positive comments !

Your fix shouldn't affect the semantics too much. However it's only a workaround, and 'None' values shouldn't appear here. I'll check where it comes from and correct this. By the way I don't spend so much time working on the master branch at the moment because I'm developing the v2.0 version in which all this semantic processing switches from python to C++ :)