search

angr / angrop

BSD 2-Clause "Simplified" License
589 stars 69 forks source link

Wip/dumb tracer #33

Closed Kyle-Kyle closed 3 years ago

Kyle-Kyle commented 3 years ago

many changes:

  1. generate ropchain in a generator manner instead of finding the "best" gadget. This allows us to handle cases where the "best" gadgets are conflict with each other and fail the longer chain generation. For example, memory setter relies on using register setters for several times. It's possible that the "best" register setters do not work. In those cases, finding the second best gadget may resolve the issue
  2. support JOP in primitive way
  3. clean up the code for a bit
  4. add timeout mechanisms in gadget analyzer to prevent hangs during gadget analysis.
  5. angrop does not handle conditional execution in arm properly, so we disable it at the moment.
rhelmot commented 3 years ago

This is way too big to review... can you add one or more tests verifying the new functionality?

Kyle-Kyle commented 3 years ago

Sure

Kyle-Kyle commented 3 years ago

I just added some tests:

  1. make sure gadget with conditional execution is filtered out on arm because currently angrop does not model conditional execution well.
  2. make sure angrop can make use of gadgets ending with jmp
  3. make sure angrop supports mips
rhelmot commented 3 years ago

lgtm!

salls commented 3 years ago

Changes seem good to me

ltfish commented 3 years ago

LGTM. Thank you!