search

sashs / Ropper

Display information about files in different file formats and find gadgets to build rop chains for different architectures (x86/x86_64, ARM/ARM64, MIPS, PowerPC, SPARC64). For disassembly ropper uses the awesome Capstone Framework.
https://scoding.de/ropper
BSD 3-Clause "New" or "Revised" License
1.87k stars 206 forks source link

Also print jump delay slot #93

Closed RobertLarsen closed 5 years ago

RobertLarsen commented 5 years ago

It would be useful when getting the disassembly for the gadgets to also get the instruction at the jump delay slot (on archs that have it) since this will also affect the execution.

What I get:

....
0x00410ab8: addiu $a0, $sp, 0x18; lw $ra, 0x24($sp); lw $s0, 0x20($sp); jr $ra;
....

What I would like:

....
0x00410ab8: addiu $a0, $sp, 0x18; lw $ra, 0x24($sp); lw $s0, 0x20($sp); jr $ra; addiu $sp, $sp, 0x28;
....
sashs commented 5 years ago

Hi, Incidentally I've received an email today that describes the same issue . Yeah, that would be useful. I will implement that.

sashs commented 5 years ago

Hi,

I've just pushed a commit. May I ask you to look at it if that is what you want?

RobertLarsen commented 5 years ago

Hi, Great seeing this getting implemeted. However, I have pulled your latest commits and see no difference in the output:

$ ./Ropper.py --file www 2>/dev/null | tail
0x0040b07c: nop; lw $t9, -0x7fc0($gp); nop; beqz $t9, 0xb09c; nop; jalr $t9; 
0x00414f1c: nop; lw $t9, -0x7ff0($gp); move $t7, $ra; jalr $t9; 
0x0041325c: nop; lw $v0, ($a0); lw $t9, 0xc($v0); jalr $t9; 
0x0040b154: nop; lw $v0, ($a0); lw $t9, 0xc($v0); jr $t9; 
0x0040b154: nop; lw $v0, ($a0); lw $t9, 0xc($v0); jr $t9; nop; jr $ra; 
0x0040b0ac: nop; lw $v0, ($a1); lw $v1, ($a2); jr $ra; 
0x0040adec: nop; lw $v0, 0x18($sp); lw $t9, 0x90($v0); jalr $t9; 
0x0040b0a8: nop; nop; lw $v0, ($a1); lw $v1, ($a2); jr $ra; 

1526 gadgets found
sashs commented 5 years ago

Hi, please clear the cache and then try it again.

./Ropper.py --clear-cache
RobertLarsen commented 5 years ago

Ohh, learned something new :-)

Yes, the new output is exactly what I wished for. Great work!

sashs commented 5 years ago

Great. I will close this issue.