search

JonathanSalwan / ROPgadget

This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.
Other
3.92k stars 553 forks source link

QUESTION: auto ROP chain generation #184

Open init5-SF opened 2 years ago

init5-SF commented 2 years ago

hello, I have a question (might sound noob, I know)

but, why does ROPGadget successfully create the python code of the ROP chain sometimes, and some other times it doesnt? And when it doesn't, what's the alternative? Can it be configured to look for the gadgets it needs elsewhere (like libc)?

SweetVishnya commented 2 years ago

ROPgadget has a pretty straightforward ROP chain generation algorithm. It just searches for some exact opcodes and chains them together. ROPgadget is mainly a gadget finding tool.

There are some more advanced tools for facilitating ROP chaining [1]. You'd better try them. We actually wrote a nice survey about different ROP chaining methods and tools [2].

However, ROPgadget is still a great tool for finding complicated gadgets. Moreover, ROPgadget is used by some ROP compilers as a ROP gadget search engine.

P.S. ROPgadget is able to search for gadgets in libc just like in any other --binary.

[1] https://github.com/ispras/rop-benchmark#supported-tools [2] https://arxiv.org/abs/2011.07862