search

sashs / Ropper

Display information about files in different file formats and find gadgets to build rop chains for different architectures (x86/x86_64, ARM/ARM64, MIPS, PowerPC, SPARC64). For disassembly ropper uses the awesome Capstone Framework.
https://scoding.de/ropper
BSD 3-Clause "New" or "Revised" License
1.84k stars 206 forks source link

Enhancement: Memory scanning, core dump parsing #84

Open eternaleclipse opened 5 years ago

eternaleclipse commented 5 years ago

Currently it is possible to scan memory only by dumping it manually to a file and using the --raw option. A useful feature would be the ability to parse core dump files (gdb can generate core dumps using the gcore command, WinDBG has a similar command called .dump) and scan executable pages in the entire process memory for gadgets. This can also be used to access the process state, register, stack etc and as suggested in #40.

sashs commented 5 years ago

Since coredumps are ELF files, it is possible to load those files with ropper without using the --raw option. However the Windows dump format is different. In order to use that filebytes has to be extended with that format.

eternaleclipse commented 5 years ago

I used ropper to scan a core file, it does work but with incorrect offset. I used objdump to find the same gadget (objdump will display the correct address for the mapped memory), calculate the offset and then used ropper -I to fix the image base. It does work but the process is kinda tedious. I'm trying to find out how to find the correct offset by parsing the core file directly.

XVilka commented 5 years ago

You can use the radare2 for loading any kind of format though, since it supports core files and minidumps of different kinds, and it's available as a library.