From f4553e20afde1d4217bb9cdc588846fa7eda4fa5 Mon Sep 17 00:00:00 2001 From: Zef Cekaj Date: Thu, 10 Jul 2014 05:19:46 -0500 Subject: [PATCH] Added support for --multibr --- ropgadget/args.py | 1 + ropgadget/core.py | 4 ++-- ropgadget/gadgets.py | 8 ++++---- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/ropgadget/args.py b/ropgadget/args.py index 61ff309..47d5bfc 100644 --- a/ropgadget/args.py +++ b/ropgadget/args.py @@ -85,6 +85,7 @@ architectures supported: parser.add_argument("--norop", action="store_true", help="Disable ROP search engine") parser.add_argument("--nojop", action="store_true", help="Disable JOP search engine") parser.add_argument("--nosys", action="store_true", help="Disable SYS search engine") + parser.add_argument("--multibr", action="store_true", help="Enable multiple branch gadgets") self.__args = parser.parse_args() if self.__args.version: diff --git a/ropgadget/core.py b/ropgadget/core.py index b63b6d6..49b4ef8 100644 --- a/ropgadget/core.py +++ b/ropgadget/core.py @@ -54,7 +54,7 @@ class Core(cmd.Cmd): if not self.__options.nosys: self.__gadgets += G.addSYSGadgets(section) # Pass clean single instruction and unknown instructions - self.__gadgets = G.passClean(self.__gadgets) + self.__gadgets = G.passClean(self.__gadgets, self.__options.multibr) # Delete duplicate gadgets self.__gadgets = rgutils.deleteDuplicateGadgets(self.__gadgets) @@ -393,7 +393,7 @@ class Core(cmd.Cmd): print "ROPchain: %s" %(self.__options.ropchain) print "String: %s" %(self.__options.string) print "Thumb: %s" %(self.__options.thumb) - + print "MultiBr: %s" %(self.__options.multibr) def help_settings(self): print "Display setting's environment" diff --git a/ropgadget/gadgets.py b/ropgadget/gadgets.py index 106dd48..1961787 100644 --- a/ropgadget/gadgets.py +++ b/ropgadget/gadgets.py @@ -34,7 +34,7 @@ class Gadgets: count += 1 return count - def __passCleanX86(self, gadgets): + def __passCleanX86(self, gadgets, multibr=False): new = [] br = ["ret", "int", "sysenter", "jmp", "call"] for gadget in gadgets: @@ -45,7 +45,7 @@ class Gadgets: continue if self.__checkInstructionBlackListedX86(insts): continue - if self.__checkMultiBr(insts, br) > 1: + if not multibr and self.__checkMultiBr(insts, br) > 1: continue if len([m.start() for m in re.finditer("ret", gadget["gadget"])]) > 1: continue @@ -189,8 +189,8 @@ class Gadgets: return self.__gadgetsFinding(section, gadgets) - def passClean(self, gadgets): - if self.__binary.getArch() == CS_ARCH_X86: return self.__passCleanX86(gadgets) + def passClean(self, gadgets, multibr): + if self.__binary.getArch() == CS_ARCH_X86: return self.__passCleanX86(gadgets, multibr) elif self.__binary.getArch() == CS_ARCH_MIPS: return gadgets elif self.__binary.getArch() == CS_ARCH_PPC: return gadgets elif self.__binary.getArch() == CS_ARCH_SPARC: return gadgets