keep gadgets with large stack shifts

angr / angrop

BSD 2-Clause "Simplified" License

606 stars 71 forks source link

keep gadgets with large stack shifts #102

Closed astewart-bah closed 6 months ago

astewart-bah commented 6 months ago

Description

It looks like angrop discards gadgets that have a stack shift > 0x100 bytes (MAX_PIVOT_BYTES).

In two recent projects, I have found it necessary to jump to a distant portion of the stack. While these gadgets may not be useful for angrop main purpose of automatically building ROP chains, these gadgets are still very valuable for manually selecting stack shifts.

Alternatives

No response

Additional context

No response

Kyle-Kyle commented 6 months ago

This is actually a bug. The stack_gsize parameter in ROP is for this purpose. But somehow it got another hardcoded value. Thank you for pointing it out.

Kyle-Kyle commented 6 months ago

it is fixed in https://github.com/angr/angrop/pull/106