Display information about files in different file formats and find gadgets to build rop chains for different architectures (x86/x86_64, ARM/ARM64, MIPS, PowerPC, SPARC64). For disassembly ropper uses the awesome Capstone Framework.
When I compared Ropper and Angrop, I unexpectedly found that There were some gadgets in Angrop that Ropper could not find. The reason was caused by disassembly error in __createGadget function in ropper/ropper/rop.py
But it is normal to call the disassembleAddress interface for disassembly. After a simple debugging, I found that the disassembler.disasm() parameter in the __createGadget function is inconsistent with the disassembler.disasm() parameter in the disassembleAddress function.
This may be the cause of partial disassembly failures
testcase:
in the binary of libc.so.6(x86);version is 2.31
GNU C Library (Ubuntu GLIBC 2.31-0ubuntu9.7) stable release version 2.31.
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC version 9.3.0.
libc ABIs: UNIQUE IFUNC ABSOLUTE
For bug reporting instructions, please see:
<https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
ipdb> for i in disassembler.disasm(b'\r\xc3', 1474192):
print("test")
ipdb> for i in disassembler.disasm(b'\x83\xc0\r\xc3', 1474192):
print("test")
test
test
$ ropper -f libc.so.6_x86 --disassemble-address 0x167e92:L2
Instructions
============
0x0014ee92: or eax, 0xec083c3
0x0014ee97: ret
0x0014ee92 this gadget can't be found using Ropper, but there are other gadgets out there, just to give you an example.
maybe this is useful to you!
ipdb> for a in disassembler.disasm(b'\r\xc3\x83\xc0\x0e\xc3',0x167e92):
print("test")
test
test
ipdb> code_str
b'\r\xc3'
ipdb> for a in disassembler.disasm(b'\r\xc3',0x167e92):
print("test")
When I compared Ropper and Angrop, I unexpectedly found that There were some gadgets in Angrop that Ropper could not find. The reason was caused by disassembly error in __createGadget function in ropper/ropper/rop.py
But it is normal to call the disassembleAddress interface for disassembly. After a simple debugging, I found that the disassembler.disasm() parameter in the __createGadget function is inconsistent with the disassembler.disasm() parameter in the disassembleAddress function.
This may be the cause of partial disassembly failures
testcase: in the binary of libc.so.6(x86);version is 2.31
0x0014ee92 this gadget can't be found using Ropper, but there are other gadgets out there, just to give you an example.
maybe this is useful to you!