search

angr / angrop

BSD 2-Clause "Simplified" License
589 stars 69 forks source link

Adds support for utilizing gadgets with syscall preamble #89

Closed Jusb3 closed 5 months ago

Jusb3 commented 6 months ago

There was TODO comment about utilizing syscalls with preamble.

This was achieved by adding preamble attribute to SyscallGadget class, that is set to the syscall number if preamble is found and None otherwise.

I made use of _windup_to_presyscall_state, but I needed to change it to check if the final_state self.is_in_kernel returns True.

Kyle-Kyle commented 5 months ago

Hi, thank you for the PR. This PR inspires me on how to deal with syscall preamble and I appreciate it. This PR suggests adding a preamble field to SyscallGadget to handle cases where syscall numbers are concretized in the syscall preamble. But I think a more general way is to use all the concretized registers. And since we already have infra (RopGadget.concrete_regs) for that, I plan to do it the more general way.

Kyle-Kyle commented 5 months ago

the new PR is here: https://github.com/angr/angrop/pull/90 with this feature done, I think we might be able to automatically find one_gadget in the future.

Jusb3 commented 5 months ago

the new PR is here: #90 with this feature done, I think we might be able to automatically find one_gadget in the future.

Cool, that sounds better approach.

Kyle-Kyle commented 5 months ago

I'll close this PR since the other one is merged. Thanks for the suggestion!