Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Keep gadgets when setting registers via setattr/call #1891

Merged
merged 2 commits into from
Jun 19, 2021

Conversation

hackedd
Copy link
Contributor

@hackedd hackedd commented May 17, 2021

Adding the gadgets to the chain (instead of their address) generates slightly better descriptions when the gadget corresponds to a symbol (and avoids having to go through unresolve).

To take the example from the doctest in __call__:

    >>> context.clear(arch='amd64')
    >>> assembly = 'pop rax; pop rdi; pop rsi; ret; pop rax; ret;'
    >>> e = ELF.from_assembly(assembly)
    >>> r = ROP(e)
    >>> r(rax=0xdead, rdi=0xbeef, rsi=0xcafe)
    >>> print(r.dump())
    0x0000:       0x10000000 pop rax; pop rdi; pop rsi; ret
    0x0008:           0xdead
    0x0010:           0xbeef
    0x0018:           0xcafe

The first item in the chain previously had no description, because there is an unnamed symbol with that address.

@heapcrash
Copy link
Collaborator

heapcrash commented May 17, 2021

Cool stuff! Mind updating CHANGELOG.md (in the dev section) and then we can merge this?

Also what is this magic r(rax=0xdead, rdi=0xbeef, rsi=0xcafe) syntax. I don't remember ever seeing that before, but it's really great!

@hackedd
Copy link
Contributor Author

hackedd commented Jun 3, 2021

Is there anything else that needs to be done to merge this?

@heapcrash
Copy link
Collaborator

It would be nice if we had describe slots for each value, so we knew which registers were being populated in each slot.

That said, that can be saved for the future.

@heapcrash heapcrash merged commit 35260c4 into Gallopsled:dev Jun 19, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants