search

Boyan-MILANOV / ropium

ROPium is a tool that helps you building ROP exploits by finding and chaining gadgets together
382 stars 41 forks source link

rdx was overwriten in example gif #35

Closed cothan closed 3 years ago

cothan commented 3 years ago

I think example GIF does a very good impression of the tool. However, in the discussion with my friends, we spot an error in the GIF, probably in the tool too, is the command

find [rdx+32]=rax, where rdx was overwritten, which lead to unexpected location.

Line 1, line 4 should be something else rather than rdx.

image

I also tried to reproduce this in libc.so.2.27 but the tool hang forever at similar find query.

My ROPium version is v3.1

Boyan-MILANOV commented 3 years ago

Hey !

Indeed there is an error in the GIF, rdx shouldn't be overwritten. The error was already fixed in the tool though, that is why you can't reproduce it. If the current version hangs on the query it means that it can't find a matching ropchain (I still have to implement a proper Ctrl+C to stop the search when it takes to long ).

I'll change the GIF and replace this query with a similar one, like find [rdx+16] = rax.

Thank you for noticing the error ! :)

Boyan-MILANOV commented 3 years ago

GIF updated