corelan / mona

Corelan Repository for mona.py
BSD 3-Clause "New" or "Revised" License
1.71k stars 564 forks source link

Sort output in rop.txt #24

Closed eranzim closed 6 years ago

eranzim commented 6 years ago

Hi :) I think it could be helpful if the output to rop.txt (and possibly other files as well?) would be sorted, by anything. I would use a default sorting by address, but perhaps if there are more sorting ideas it's possible to add a command line flag to change default behavior. Sounds to me like it's basically casting a set to a list and calling sort at some point in the code, but seeing as it's a 18+ KLOC file, it's hard for me to tell for certain.

corelanc0d3r commented 6 years ago

Hi,

for sure it would be possible to sort rop.txt (and other files), but I am wondering what the added value would be of sorting rop.txt. The file is supposed to be used as a source for "grep" like operations anyway.

In most cases, the internal structures that hold addresses and values are dictionaries, so it should be possible to print them in a sorted fashion indeed. I guess the sorting would create some overhead, so I'm not sure if it would be an option I'd like to activate by default

eranzim commented 6 years ago

It could be a command-line option, off by default, to reduce the overhead. This is the use case I was thinking about: Once I generated the file, I looked for a certain pattern or command I wanted to use. So then say I was looking for INC EDX, rop.txt could have all of the following in its output:

# CMD1 # CMD2 # INC EDX # CMD3 # RETN
# CMD2 # INC EDX # CMD3 # RETN
# INC EDX # CMD3 # RETN

Only they would be scattered around. Sorting them would allow me to see them all together when moving around rop.txt with Ctrl+F in my text editor of choice (or even in the output of grep, for that matter).

corelanc0d3r commented 6 years ago

I have added a -sort switch to mona rop, sorting the pointers in rop.txt. Hope this helps :)

eranzim commented 6 years ago

Thanks!! :)