sashs / Ropper

Display information about files in different file formats and find gadgets to build rop chains for different architectures (x86/x86_64, ARM/ARM64, MIPS, PowerPC, SPARC64). For disassembly ropper uses the awesome Capstone Framework.
https://scoding.de/ropper
BSD 3-Clause "New" or "Revised" License
1.88k stars 206 forks source link

TypeError: unsupported operand type(s) for %: 'bytes' and 'tuple' #123

Open bcoles opened 4 years ago

bcoles commented 4 years ago

Ubuntu 14.04.5 amd64 Python 3.4.3.

user@ubuntu:~/Desktop$ uname -a
Linux ubuntu 4.4.0-31-generic #50~14.04.1-Ubuntu SMP Wed Jul 13 01:07:32 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
user@ubuntu:~/Desktop$ python2 --version
Python 2.7.6
user@ubuntu:~/Desktop$ python3 --version
Python 3.4.3
user@ubuntu:~/Desktop$ sudo ./extract-vmlinux /boot/vmlinuz-4.4.0-31-generic > vmlinuz-4.4.0-31-generic.elf
user@ubuntu:~/Desktop$ cd Ropper/
user@ubuntu:~/Desktop/Ropper$ git pull
Already up-to-date.
user@ubuntu:~/Desktop/Ropper$ python3 ./Ropper.py --file ../vmlinuz-4.4.0-31-generic.elf --instruction "swapgs ; pop rbp ; ret"
[ERROR] Please report this error on https://github.com/sashs/ropper
[ERROR] Traceback (most recent call last):
  File "/home/user/Desktop/Ropper/ropper/console.py", line 62, in cmd
    func(self, text)
  File "/home/user/Desktop/Ropper/ropper/console.py", line 477, in __handleOptions
    self.__searchInstructions(self.__options.instructions)
  File "/home/user/Desktop/Ropper/ropper/console.py", line 286, in __searchInstructions
    name=self.currentFileName, code=code)
  File "/home/user/Desktop/Ropper/ropper/service.py", line 588, in searchInstructions
    to_return[name] = self.__ropper.searchInstructions(fc.loader, code)
  File "/home/user/Desktop/Ropper/ropper/rop.py", line 200, in searchInstructions
    return self.searchOpcode(binary, opcode, disass=True)
  File "/home/user/Desktop/Ropper/ropper/rop.py", line 205, in searchOpcode
    opcode, size = self._formatOpcodeString(opcode)
  File "/home/user/Desktop/Ropper/ropper/rop.py", line 164, in _formatOpcodeString
    opcode = opcode.replace(b,b'%s%s' % (hexlify(b'\\'),b))
TypeError: unsupported operand type(s) for %: 'bytes' and 'tuple'

user@ubuntu:~/Desktop/Ropper$ python2.7 ./Ropper.py --file ../vmlinuz-4.4.0-31-generic.elf --instruction "swapgs ; pop rbp ; ret"

Instructions
============

0xffffffff810613d4: swapgs; pop rbp; ret; 

1 gadgets found

This issue only appears for some gadgets.

user@ubuntu:~/Desktop/Ropper$ python2 ./Ropper.py --file ../vmlinuz-4.4.0-31-generic.elf --instruction "swapgs ; pop rbp ; ret"

Instructions
============

0xffffffff810613d4: swapgs; pop rbp; ret; 

1 gadgets found
user@ubuntu:~/Desktop/Ropper$ python3 ./Ropper.py --file ../vmlinuz-4.4.0-31-generic.elf --instruction "swapgs ; pop rbp ; ret"
[ERROR] Please report this error on https://github.com/sashs/ropper
[ERROR] Traceback (most recent call last):
  File "/home/user/Desktop/Ropper/ropper/console.py", line 62, in cmd
    func(self, text)
  File "/home/user/Desktop/Ropper/ropper/console.py", line 477, in __handleOptions
    self.__searchInstructions(self.__options.instructions)
  File "/home/user/Desktop/Ropper/ropper/console.py", line 286, in __searchInstructions
    name=self.currentFileName, code=code)
  File "/home/user/Desktop/Ropper/ropper/service.py", line 588, in searchInstructions
    to_return[name] = self.__ropper.searchInstructions(fc.loader, code)
  File "/home/user/Desktop/Ropper/ropper/rop.py", line 200, in searchInstructions
    return self.searchOpcode(binary, opcode, disass=True)
  File "/home/user/Desktop/Ropper/ropper/rop.py", line 205, in searchOpcode
    opcode, size = self._formatOpcodeString(opcode)
  File "/home/user/Desktop/Ropper/ropper/rop.py", line 164, in _formatOpcodeString
    opcode = opcode.replace(b,b'%s%s' % (hexlify(b'\\'),b))
TypeError: unsupported operand type(s) for %: 'bytes' and 'tuple'

user@ubuntu:~/Desktop/Ropper$ python2 ./Ropper.py --file ../vmlinuz-4.4.0-31-generic.elf --instruction "iretq"

Instructions
============

0xffffffff8101bd8a: iretq; 
0xffffffff81042d38: iretq; 
0xffffffff81093304: iretq; 
0xffffffff81093367: iretq; 
0xffffffff810f80c5: iretq; 
0xffffffff811f88f0: iretq; 
0xffffffff81249c34: iretq; 
0xffffffff81331ee7: iretq; 
0xffffffff813327d9: iretq; 
0xffffffff81367268: iretq; 
0xffffffff81368031: iretq; 
0xffffffff813683ae: iretq; 
0xffffffff81369836: iretq; 
0xffffffff81371d06: iretq; 
0xffffffff81372152: iretq; 
0xffffffff8153b283: iretq; 
0xffffffff8153b2ad: iretq; 
0xffffffff8153b325: iretq; 
0xffffffff8153b343: iretq; 
0xffffffff8153bfd9: iretq; 
0xffffffff8153c008: iretq; 
0xffffffff8153c038: iretq; 
0xffffffff8153c057: iretq; 
0xffffffff8153c186: iretq; 
0xffffffff8153c1a4: iretq; 
0xffffffff8161d784: iretq; 
0xffffffff816969d4: iretq; 
0xffffffff817f7a97: iretq; 
0xffffffff8182e030: iretq; 
0xffffffff8193ede8: iretq; 
0xffffffff81964911: iretq; 
0xffffffff8196bd18: iretq; 
0xffffffff81977138: iretq; 
0xffffffff8197ca90: iretq; 
0xffffffff81980478: iretq; 
0xffffffff8208d4a9: iretq; 
0xffffffff820b75e0: iretq; 

37 gadgets found
user@ubuntu:~/Desktop/Ropper$ python3 ./Ropper.py --file ../vmlinuz-4.4.0-31-generic.elf --instruction "iretq"

Instructions
============

0xffffffff8101bd8a: iretq; 
0xffffffff81042d38: iretq; 
0xffffffff81093304: iretq; 
0xffffffff81093367: iretq; 
0xffffffff810f80c5: iretq; 
0xffffffff811f88f0: iretq; 
0xffffffff81249c34: iretq; 
0xffffffff81331ee7: iretq; 
0xffffffff813327d9: iretq; 
0xffffffff81367268: iretq; 
0xffffffff81368031: iretq; 
0xffffffff813683ae: iretq; 
0xffffffff81369836: iretq; 
0xffffffff81371d06: iretq; 
0xffffffff81372152: iretq; 
0xffffffff8153b283: iretq; 
0xffffffff8153b2ad: iretq; 
0xffffffff8153b325: iretq; 
0xffffffff8153b343: iretq; 
0xffffffff8153bfd9: iretq; 
0xffffffff8153c008: iretq; 
0xffffffff8153c038: iretq; 
0xffffffff8153c057: iretq; 
0xffffffff8153c186: iretq; 
0xffffffff8153c1a4: iretq; 
0xffffffff8161d784: iretq; 
0xffffffff816969d4: iretq; 
0xffffffff817f7a97: iretq; 
0xffffffff8182e030: iretq; 
0xffffffff8193ede8: iretq; 
0xffffffff81964911: iretq; 
0xffffffff8196bd18: iretq; 
0xffffffff81977138: iretq; 
0xffffffff8197ca90: iretq; 
0xffffffff81980478: iretq; 
0xffffffff8208d4a9: iretq; 
0xffffffff820b75e0: iretq; 

37 gadgets found
user@ubuntu:~/Desktop/Ropper$ 

Python environment may be at fault.

user@ubuntu:~/Desktop/Ropper$ python3 ./Ropper.py -v
Version: Ropper 1.13.5
Author: Sascha Schirra
Website: http://scoding.de/ropper

user@ubuntu:~/Desktop/Ropper$ python2 ./Ropper.py -v
Version: Ropper 1.13.5
Author: Sascha Schirra
Website: http://scoding.de/ropper

user@ubuntu:~/Desktop/Ropper$ python3 -m ropper -v
/usr/bin/python3: Error while finding spec for 'ropper.__main__' (<class 'ImportError'>: No module named 'filebytes.pe'); 'ropper' is a package and cannot be directly executed
user@ubuntu:~/Desktop/Ropper$ python2 -m ropper -v 
/usr/bin/python2: No module named filebytes.pe; 'ropper' is a package and cannot be directly executed
user@ubuntu:~/Desktop/Ropper$