Gallopsled / pwntools

CTF framework and exploit development library
http://pwntools.com
Other
12.15k stars 1.72k forks source link

Capstone update breaks ropgadget #2491

Open pmondon opened 1 month ago

pmondon commented 1 month ago

Capstone has been updated to 6.0.0a1, subsequently, pwntools isn't working (see bellow). A working patch for me is to downgrade capstone to 5.0.3

[*] '{PATH}tenda-pwn/tendafs/bin/httpd'
    Arch:       arm-32-little
    RELRO:      No RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x8000)
[*] '{PATH}tenda-pwn/tendafs/lib/libc.so.0'
    Arch:       arm-32-little
    RELRO:      Full RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
[*] Loading gadgets for '{PATH}tenda-pwn/tendafs/bin/httpd'
Traceback (most recent call last):
  File "{PATH}tenda-pwn/attack.py", line 11, in <module>
    rop = ROP(elf)
          ^^^^^^^^
  File "{condapath}.conda/envs/pwn/lib/python3.11/site-packages/pwnlib/rop/rop.py", line 626, in __init__
    self.__load()
  File "{condapath}.conda/envs/pwn/lib/python3.11/site-packages/pwnlib/rop/rop.py", line 1356, in __load
    core.do_load(0)
  File "{condapath}.conda/envs/pwn/lib/python3.11/site-packages/ropgadget/core.py", line 307, in do_load
    self.__getGadgets()
  File "{condapath}.conda/envs/pwn/lib/python3.11/site-packages/ropgadget/core.py", line 70, in __getGadgets
    G = Gadgets(self.__binary, self.__options, self.__offset)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "{condapath}.conda/envs/pwn/lib/python3.11/site-packages/ropgadget/gadgets.py", line 24, in __init__
    elif self.__arch == CS_ARCH_ARM64:
                        ^^^^^^^^^^^^^
NameError: name 'CS_ARCH_ARM64' is not defined
peace-maker commented 1 month ago

This only breaks when trying to load rop gadgets for aarch64 binaries btw. We only test for x86, which is why this didn't trigger in CI. I don't think the ROP class properly supports anything but x86/x86_64 too.