sashs / Ropper

Display information about files in different file formats and find gadgets to build rop chains for different architectures (x86/x86_64, ARM/ARM64, MIPS, PowerPC, SPARC64). For disassembly ropper uses the awesome Capstone Framework.
https://scoding.de/ropper
BSD 3-Clause "New" or "Revised" License
1.85k stars 207 forks source link

Cannot Find some Gadgets because of disassemble error ! #156

Open ZoEplA opened 2 years ago

ZoEplA commented 2 years ago

When I compared Ropper and Angrop, I unexpectedly found that There were some gadgets in Angrop that Ropper could not find. The reason was caused by disassembly error in __createGadget function in ropper/ropper/rop.py

But it is normal to call the disassembleAddress interface for disassembly. After a simple debugging, I found that the disassembler.disasm() parameter in the __createGadget function is inconsistent with the disassembler.disasm() parameter in the disassembleAddress function.

This may be the cause of partial disassembly failures

testcase: in the binary of libc.so.6(x86);version is 2.31

GNU C Library (Ubuntu GLIBC 2.31-0ubuntu9.7) stable release version 2.31.
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC version 9.3.0.
libc ABIs: UNIQUE IFUNC ABSOLUTE
For bug reporting instructions, please see:
<https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
ipdb> for i in disassembler.disasm(b'\r\xc3', 1474192):
    print("test")

ipdb> for i in disassembler.disasm(b'\x83\xc0\r\xc3', 1474192):
    print("test")

test
test
$ ropper -f libc.so.6_x86 --disassemble-address 0x167e92:L2

Instructions
============

0x0014ee92: or eax, 0xec083c3
0x0014ee97: ret

0x0014ee92 this gadget can't be found using Ropper, but there are other gadgets out there, just to give you an example.

maybe this is useful to you!

ipdb> for a in disassembler.disasm(b'\r\xc3\x83\xc0\x0e\xc3',0x167e92):
    print("test")

test
test
ipdb> code_str
b'\r\xc3'
ipdb> for a in disassembler.disasm(b'\r\xc3',0x167e92):
    print("test")
sashs commented 2 years ago

Hey. Apologize the delay, can you provide the binary?

ZoEplA commented 2 years ago

libc.so.6_x86.zip here is the binary file.

ZoEplA commented 2 years ago

Sorry, didn't notice your reply message