search

angr / angrop

BSD 2-Clause "Simplified" License
589 stars 69 forks source link

TODO Features #69

Open Kyle-Kyle opened 7 months ago

Kyle-Kyle commented 7 months ago

1. handle gadgets like

[ins] In [2]: chain.print_payload_code()
chain = b""
chain += p32(0x809d9f7) # mov eax, dword ptr [esp + 4]; ret 0xc
chain += p32(0x1010101)
chain += p32(0x0)
chain += p32(0xf5f5f5f5)

The issue is that this gadget requires another pop gadget to function correctly. But angrop currently does not support this. Should be easy enough by adding a special "gadget value" without interfering with the gadget effect

2. change how angrop works fundamentally to get rid of the assumption of each gadget transition performs similar to a ret