admin/JonathanSalwan-ROPgadget
1
0
Fork 0
mirror of https://github.com/JonathanSalwan/ROPgadget synced 2026-06-08 11:25:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

add feature -limit & -string

Browse Source
This commit is contained in:
Jonathan Salwan
2011-10-17 15:07:50 +02:00
parent b60f637327
commit 7fbc34b7e0
25 changed files with 12588 additions and 147 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+7 -1
View File
@@ -21,7 +21,7 @@ SRC_DIR = ./src
NAME = ROPgadget
ifeq ($(DEBUG),yes)
CFLAGS = -g3 -ggdb -Wextra -Wall -D _BSD_SOURCE -I$(INCLUDE)
CFLAGS = -g3 -ggdb -Wextra -Wall -D _BSD_SOURCE -I$(INCLUDE)
CC = clang
else
CFLAGS = -W -Wall -ansi -pedantic -D _BSD_SOURCE -I$(INCLUDE)
@@ -40,9 +40,11 @@ SRC = $(SRC_DIR)/main.c \
$(SRC_DIR)/get_flags.c \
$(SRC_DIR)/get_seg.c \
$(SRC_DIR)/check_exec_maps.c \
$(SRC_DIR)/check_read_maps.c \
$(SRC_DIR)/ropmaker.c \
$(SRC_DIR)/makecode.c \
$(SRC_DIR)/return_maps_exec.c \
$(SRC_DIR)/return_maps_read.c \
$(SRC_DIR)/makecode_importsc.c \
$(SRC_DIR)/how_many_found.c \
$(SRC_DIR)/combo_ropmaker1.c \
@@ -55,15 +57,19 @@ SRC = $(SRC_DIR)/main.c \
$(SRC_DIR)/check_filter_mode.c \
$(SRC_DIR)/check_only_mode.c \
$(SRC_DIR)/check_opcode_mode.c \
$(SRC_DIR)/check_string_mode.c \
$(SRC_DIR)/check_asm_mode.c \
$(SRC_DIR)/check_importsc_mode.c \
$(SRC_DIR)/check_elfheader_mode.c \
$(SRC_DIR)/check_progheader_mode.c \
$(SRC_DIR)/check_sectheader_mode.c \
$(SRC_DIR)/check_syntax_mode.c \
$(SRC_DIR)/check_limit_mode.c \
$(SRC_DIR)/no_filtered.c \
$(SRC_DIR)/varop.c \
$(SRC_DIR)/onlymode.c
OBJ = $(SRC:.c=.o)
all: $(NAME)
README.md
+40 -14
View File
@@ -1,10 +1,10 @@
ROPgadget
=========
ROPgadget Tool
==============
This tool lets you search your gadgets on your binaries (ELF format) to facilitate your ROP exploitation.
Since version 3.0, ROPgadget has a auto-roper for build your payload automatically with the gadgets found.
* [Web Site](http://shell-storm.org/project/ROPgadget/)
* [Web Site Project](http://shell-storm.org/project/ROPgadget/)
@@ -31,18 +31,22 @@ Usage
* `-g` Search gadgets add make payload
* `-v` Version
<b>Flags</b>
Flags
* `-bind` Set this flag for make a bind shellcode (optional) (Default local exploit)
* `-port` &lt;port&gt; Set a listen port, optional (Default 1337)
* `-importsc` &lt;shellcode&gt; Make payload and convert your shellcode in ROP payload
* `-filter` &lt;word&gt; Word filter (research slowed)
* `-only` &lt;keyword&gt; Keyword research (research slowed)
* `-opcode` &lt;opcode&gt; Search a specific opcode on exec segment
* `-asm` &lt;instructions&gt; Search a specific instructions on exec segment
* `-elfheader` Display ELF Header before searching gadgets
* `-progheader` Display Program Header before searching gadgets
* `-sectheader` Display Section Header before searching gadgets
<pre>
-bind Set this flag for make a bind shellcode (optional) (Default local exploit)
-port &lt;port&gt; Set a listen port, optional (Default 1337)
-importsc &lt;shellcode&gt; Make payload and convert your shellcode in ROP payload
-filter &lt;word&gt; Word filter (research slowed)
-only &lt;keyword&gt; Keyword research (research slowed)
-opcode &lt;opcode&gt; Search a specific opcode on exec segment
-string &lt;string&gt; Search a specific hard string on read segment ('?' any char)
-asm &lt;instructions&gt; Search a specific instructions on exec segment
-limit &lt;value&gt; Limit the display of gadgets
-elfheader Display ELF Header before searching gadgets
-progheader Display Program Header before searching gadgets
-sectheader Display Section Header before searching gadgets
</pre>
<b>Ex</b>
@@ -55,3 +59,25 @@ Usage
./ROPgadget -g ./smashme.bin -asm "int \$0x80"
Memo
----
The tool can find a gadget in other gadget.
ropgadget find it: `0x0806bb68: mov $0x5e5bf089,%edi | ret`
<pre>
│ │
│ 806bb68 ! bf db 0bfh │
│ 806bb69 ! │
│ ....... ! loc_806bb69: ;xref j806bb4c j806bb53 j806bb5e │
│ ....... ! 89f0 mov eax, esi │
│ 806bb6b ! │
│ ....... ! loc_806bb6b: ;xref j806bb2e j806bb36 j806bb3d │
│ ....... ! ;xref j806bb44 j806bb70 j806bb77 │
│ ....... ! ;xref j806bb7e │
│ ....... ! 5b pop ebx │
│ 806bb6c ! 5e pop esi │
│ 806bb6d ! c3 ret |
│ 806bb6e ! |
</pre>
binary-test/linux-arm
Executable
BIN
View File
Binary file not shown.
binary-test/linux64
Executable
BIN
View File
Binary file not shown.
binary-test/main.b64
Executable
+12005
View File
File diff suppressed because it is too large Load Diff
includes/ropgadget.h
+47 -5
View File
@@ -25,7 +25,7 @@
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <sys/wait.h>
#include <wait.h>
#include <fcntl.h>
#include <elf.h>
@@ -58,6 +58,14 @@ typedef struct s_maps_exec
struct s_maps_exec *next;
} t_maps_exec;
/* Linked list for phdr map with read bit */
typedef struct s_maps_read
{
Elf32_Addr addr_start;
Elf32_Addr addr_end;
struct s_maps_read *next;
} t_maps_read;
/* Ropmaker */
typedef struct s_ropmaker
{
@@ -118,6 +126,13 @@ typedef struct s_opcode
int flag;
} t_opcode;
typedef struct s_stringmode
{
char *string;
size_t size;
int flag;
} t_stringmode;
typedef struct s_asm_mode
{
char *argument;
@@ -151,6 +166,20 @@ typedef struct s_option
char *dfile;
} t_option;
typedef struct s_syntaxcode
{
int flag_pysyn;
int flag_csyn;
int flag_phpsyn;
int flag_perlsyn;
} t_syntaxcode;
typedef struct s_limitmode
{
int flag;
int value;
} t_limitmode;
/* globals vars */
Elf32_Ehdr *pElf_Header;
Elf32_Phdr *pElf32_Phdr;
@@ -159,6 +188,7 @@ Elf32_Shdr *pElf32_HeaderSection;
Elf32_Shdr *pElf32_StringSection;
Elf32_Addr Addr_sData;
Elf32_Addr Addr_sGot;
void *pMapElf;
t_asm *pGadgets;
t_filter_linked *filter_linked;
@@ -173,11 +203,14 @@ int flag_elfheader;
/* flag options */
t_option pOption; /* -g or -d */
t_opcode opcode_mode; /* -opcode */
t_stringmode stringmode; /* -string */
t_asm_mode asm_mode; /* -asm */
t_importsc importsc_mode; /* -importsc */
t_bind_mode bind_mode; /* -bind & -port */
t_filter_mode filter_mode; /* -filter */
t_only_mode only_mode; /* -only */
t_limitmode limitmode; /* -limit */
t_syntaxcode syntaxcode; /* -pysyn -csyn -phpsyn -perlsyn */
/* core */
char *get_flags(Elf32_Word);
@@ -195,24 +228,32 @@ int check_exec_maps(t_maps_exec *, Elf32_Addr);
void free_add_maps_exec(t_maps_exec *);
void display_info_header(void);
t_maps_exec *return_maps_exec(void);
t_maps_read *return_maps_read(void);
int check_read_maps(t_maps_read *, Elf32_Addr);
void free_add_maps_read(t_maps_read *);
void free_var_opcode(t_varop *element);
void check_g_mode(char **);
void check_d_mode(char **);
void check_v_mode(char **);
void check_filtre_mode(char **);
void check_opcode_mode(char **);
void check_string_mode(char **);
void check_asm_mode(char **);
void check_importsc_mode(char **);
void check_elfheader_mode(char **);
void check_progheader_mode(char **);
void check_sectheader_mode(char **);
void check_syntax_mode(char **);
void check_limit_mode(char **);
void how_many_found(void);
t_varop *add_element_varop(t_varop *, char *, Elf32_Addr);
void free_var_opcode(t_varop *);
int check_interrogation(char *);
int calc_pos_charany(char *);
char *ret_instruction_interrogation(Elf32_Addr, char *, char *);
char *ret_instruction_diese(Elf32_Addr, char *, char *);
int calc_pos_charany(char *, int);
char *ret_instruction_interrogation(Elf32_Addr, char *, char *, int);
char *ret_instruction_diese(Elf32_Addr, char *, char *, int);
int check_if_varop_was_printed(char *);
int interrogation_or_diese(char *);
int no_filtered(char *);
@@ -231,6 +272,7 @@ void combo_ropmaker_importsc(void);
char *get_gadget_since_addr(Elf32_Addr);
Elf32_Addr search_instruction(char *);
int match(const char *, const char *, size_t);
int match2(const char *, const char *, size_t);
/* makecode */
t_makecode *add_element(t_makecode *, char *, Elf32_Addr);
@@ -240,7 +282,7 @@ void check_bind_mode(char **);
/* x86-32bits */
void gadget_x8632(unsigned char *, unsigned int, Elf32_Addr, int, t_maps_exec *);
void x8632(unsigned char *, unsigned int, t_maps_exec *);
void x8632(unsigned char *, unsigned int, t_maps_exec *, t_maps_read *);
#endif
memo/gadget_in_other_gadget.txt
+13 -13
View File
@@ -4,18 +4,18 @@ ropgadget find it:
(gadget in other gadget)
│ │
│ 806bb68 ! bf db 0bfh │
│ 806bb69 ! │
│ ....... ! loc_806bb69: ;xref j806bb4c j806bb53 j806bb5e │
│ ....... ! 89f0 mov eax, esi │
│ 806bb6b ! │
│ ....... ! loc_806bb6b: ;xref j806bb2e j806bb36 j806bb3d │
│ ....... ! ;xref j806bb44 j806bb70 j806bb77 │
│ ....... ! ;xref j806bb7e │
│ ....... ! 5b pop ebx │
│ 806bb6c ! 5e pop esi │
│ 806bb6d ! c3 ret │
│ 806bb6e !
│ │
│ 806bb68 ! bf db 0bfh │
│ 806bb69 ! │
│ ....... ! loc_806bb69: ;xref j806bb4c j806bb53 j806bb5e │
│ ....... ! 89f0 mov eax, esi │
│ 806bb6b ! │
│ ....... ! loc_806bb6b: ;xref j806bb2e j806bb36 j806bb3d │
│ ....... ! ;xref j806bb44 j806bb70 j806bb77 │
│ ....... ! ;xref j806bb7e │
│ ....... ! 5b pop ebx │
│ 806bb6c ! 5e pop esi │
│ 806bb6d ! c3 ret |
│ 806bb6e ! |
src/check_arch_supported.c
+8 -3
View File
@@ -17,6 +17,11 @@
#include <stdio.h>
#include "ropgadget.h"
#define LINUX pElf_Header->e_ident[EI_OSABI] == ELFOSABI_NONE
#define FREEBSD pElf_Header->e_ident[EI_OSABI] == ELFOSABI_FREEBSD
#define ELF_F pElf_Header->e_ident[EI_CLASS] == ELFCLASS32
#define PROC8632 pElf_Header->e_machine == EM_386
void no_arch_supported(void)
{
fprintf(stderr, "Error: Architecture isn't supported\n");
@@ -25,11 +30,11 @@ void no_arch_supported(void)
int check_arch_supported(void)
{
/* supported: - Linux/x86-32bits */
if (pElf_Header->e_ident[EI_CLASS] == ELFCLASS32 && pElf_Header->e_ident[EI_OSABI] == ELFOSABI_NONE && pElf_Header->e_machine == EM_386)
return (0);
/* supported: - FreeBSD/x86-32bits */
if (pElf_Header->e_ident[EI_CLASS] == ELFCLASS32 && pElf_Header->e_ident[EI_OSABI] == ELFOSABI_FREEBSD && pElf_Header->e_machine == EM_386)
if (ELF_F && (LINUX || FREEBSD) && PROC8632)
return (0);
return (-1);
}
src/check_bind_mode.c
-1
View File
@@ -22,7 +22,6 @@ void check_bind_mode(char **argv)
memset(bind_mode.port, 0x00, sizeof(bind_mode.port));
strcpy(bind_mode.port, "1337"); /* set a default port */
bind_mode.flag = 0;
while (argv[i] != NULL)
{
if (!strcmp(argv[i], "-bind"))
src/check_g_mode.c
+35 -14
View File
@@ -51,6 +51,38 @@ static void save_section_header(void)
pElf32_Shdr -= x;
}
static void set_all_flag(void)
{
flag_sectheader = 0;
flag_progheader = 0;
flag_elfheader = 0;
syntaxcode.flag_pysyn = 1; /* python syntax by default */
syntaxcode.flag_csyn = 0;
syntaxcode.flag_phpsyn = 0;
syntaxcode.flag_perlsyn = 0;
limitmode.flag = 0;
limitmode.value = -1; /* default unlimited */
opcode_mode.flag = 0;
stringmode.flag = 0;
bind_mode.flag = 0;
}
static void check_all_flag(char **argv)
{
check_elfheader_mode(argv);
check_progheader_mode(argv);
check_sectheader_mode(argv);
check_bind_mode(argv);
check_filtre_mode(argv);
check_only_mode(argv);
check_opcode_mode(argv);
check_asm_mode(argv);
check_importsc_mode(argv);
check_syntax_mode(argv);
check_limit_mode(argv);
check_string_mode(argv);
}
void check_g_mode(char **argv)
{
struct stat filestat;
@@ -70,10 +102,7 @@ void check_g_mode(char **argv)
perror("stat");
exit(EXIT_FAILURE);
}
flag_sectheader = 0;
flag_progheader = 0;
flag_elfheader = 0;
set_all_flag();
size = filestat.st_size;
data = save_bin_data(pOption.gfile, size);
pElf_Header = (Elf32_Ehdr *)data;
@@ -86,16 +115,8 @@ void check_g_mode(char **argv)
no_arch_supported();
save_section_header();
check_elfheader_mode(argv);
check_progheader_mode(argv);
check_sectheader_mode(argv);
check_bind_mode(argv);
check_filtre_mode(argv);
check_only_mode(argv);
check_opcode_mode(argv);
check_asm_mode(argv);
check_importsc_mode(argv);
search_gadgets(data, size);
check_all_flag(argv);
search_gadgets(data, size); /* let's go */
free(data);
exit(EXIT_SUCCESS);
}
src/check_limit_mode.c
Executable
+47
View File
@@ -0,0 +1,47 @@
/*
** RopGadget - Dev v3.3
** Jonathan Salwan - http://twitter.com/JonathanSalwan
** http://shell-storm.org
** 2011-10-16
**
** Redistribution and use in source and binary forms, with or without
** modification, are permitted provided that the following conditions
** are met:
** 1. Redistributions of source code must retain the above copyright
** notice, this list of conditions and the following disclaimer.
** 2. Redistributions in binary form must reproduce the above copyright
** notice, this list of conditions and the following disclaimer in the
** documentation and/or other materials provided with the distribution.
*/
#include "ropgadget.h"
void check_limit_mode(char **argv)
{
int i = 0;
asm_mode.flag = 0;
while (argv[i] != NULL)
{
if (!strcmp(argv[i], "-limit"))
{
if (argv[i + 1] != NULL && argv[i + 1][0] != '\0')
{
limitmode.flag = 1;
limitmode.value = atoi(argv[i + 1]);
if (limitmode.value < 0 || limitmode.value > 0xfffe)
{
fprintf(stderr, "Error value\n");
exit(EXIT_FAILURE);
}
}
else
{
fprintf(stderr, "Syntax: -limit <value>\n\n");
fprintf(stderr, "Ex: -limit 100\n");
exit(EXIT_FAILURE);
}
}
i++;
}
}
src/check_opcode_mode.c
-1
View File
@@ -81,7 +81,6 @@ void check_opcode_mode(char **argv)
{
int i = 0;
opcode_mode.flag = 0;
while (argv[i] != NULL)
{
if (!strcmp(argv[i], "-opcode"))
src/check_read_maps.c
Executable
+29
View File
@@ -0,0 +1,29 @@
/*
** RopGadget - Dev v3.3
** Jonathan Salwan - http://twitter.com/JonathanSalwan
** http://shell-storm.org
** 2011-10-16
**
** Redistribution and use in source and binary forms, with or without
** modification, are permitted provided that the following conditions
** are met:
** 1. Redistributions of source code must retain the above copyright
** notice, this list of conditions and the following disclaimer.
** 2. Redistributions in binary form must reproduce the above copyright
** notice, this list of conditions and the following disclaimer in the
** documentation and/or other materials provided with the distribution.
*/
#include "ropgadget.h"
/* Check if phdr have a READ bit */
int check_read_maps(t_maps_read *read_maps, Elf32_Addr addr)
{
while (read_maps != NULL)
{
if (addr >= read_maps->addr_start && addr <= read_maps->addr_end)
return (TRUE);
read_maps = read_maps->next;
}
return (FALSE);
}
src/check_string_mode.c
Executable
+42
View File
@@ -0,0 +1,42 @@
/*
** RopGadget - Dev v3.3
** Jonathan Salwan - http://twitter.com/JonathanSalwan
** http://shell-storm.org
** 2011-10-16
**
** Redistribution and use in source and binary forms, with or without
** modification, are permitted provided that the following conditions
** are met:
** 1. Redistributions of source code must retain the above copyright
** notice, this list of conditions and the following disclaimer.
** 2. Redistributions in binary form must reproduce the above copyright
** notice, this list of conditions and the following disclaimer in the
** documentation and/or other materials provided with the distribution.
*/
#include "ropgadget.h"
void check_string_mode(char **argv)
{
int i = 0;
while (argv[i] != NULL)
{
if (!strcmp(argv[i], "-string"))
{
if (argv[i + 1] != NULL && argv[i + 1][0] != '\0')
{
stringmode.string = argv[i + 1];
stringmode.size = strlen(argv[i + 1]);
stringmode.flag = 1;
}
else
{
fprintf(stderr, "Syntax: -string <string>\n\n");
fprintf(stderr, "Ex: -string \"key\"\n");
exit(EXIT_FAILURE);
}
}
i++;
}
}
src/check_syntax_mode.c
Executable
+93
View File
@@ -0,0 +1,93 @@
/*
** RopGadget - Dev v3.3
** Jonathan Salwan - http://twitter.com/JonathanSalwan
** http://shell-storm.org
** 2011-10-16
**
** Redistribution and use in source and binary forms, with or without
** modification, are permitted provided that the following conditions
** are met:
** 1. Redistributions of source code must retain the above copyright
** notice, this list of conditions and the following disclaimer.
** 2. Redistributions in binary form must reproduce the above copyright
** notice, this list of conditions and the following disclaimer in the
** documentation and/or other materials provided with the distribution.
*/
#include "ropgadget.h"
static void check_pysyn_mode(char **argv)
{
int i = 0;
while (argv[i] != NULL)
{
if (!strcmp(argv[i], "-pysyn"))
{
syntaxcode.flag_pysyn = 1;
syntaxcode.flag_csyn = 0;
syntaxcode.flag_phpsyn = 0;
syntaxcode.flag_perlsyn = 0;
}
i++;
}
}
static void check_csyn_mode(char **argv)
{
int i = 0;
while (argv[i] != NULL)
{
if (!strcmp(argv[i], "-csyn"))
{
syntaxcode.flag_pysyn = 0;
syntaxcode.flag_csyn = 1;
syntaxcode.flag_phpsyn = 0;
syntaxcode.flag_perlsyn = 0;
}
i++;
}
}
static void check_phpsyn_mode(char **argv)
{
int i = 0;
while (argv[i] != NULL)
{
if (!strcmp(argv[i], "-phpsyn"))
{
syntaxcode.flag_pysyn = 0;
syntaxcode.flag_csyn = 0;
syntaxcode.flag_phpsyn = 1;
syntaxcode.flag_perlsyn = 0;
}
i++;
}
}
static void check_perlsyn_mode(char **argv)
{
int i = 0;
while (argv[i] != NULL)
{
if (!strcmp(argv[i], "-perlsyn"))
{
syntaxcode.flag_pysyn = 0;
syntaxcode.flag_csyn = 0;
syntaxcode.flag_phpsyn = 0;
syntaxcode.flag_perlsyn = 1;
}
i++;
}
}
void check_syntax_mode(char **argv)
{
check_pysyn_mode(argv);
check_csyn_mode(argv);
check_phpsyn_mode(argv);
check_perlsyn_mode(argv);
}
src/gadget_x8632.c
+81 -70
View File
@@ -418,7 +418,7 @@ t_asm tab_x8632[] =
** ---------------
**
** '?' is for 1 any byte direct value
** '#' if for 4 any bytes direct value
** '_' if for 4 any bytes direct value
*/
{0, 0, "add $0x?,%al | ret", "\x04?\xc3", 3},
{0, 0, "add $0x?,%bl | ret", "\x80\xc3?\xc3", 4},
@@ -470,58 +470,58 @@ t_asm tab_x8632[] =
{0, 0, "xor $0x?,%edi | pop %ebp | ret", "\x83\xf7?\x5d\xc3", 4},
/* 4 any bytes */
{0, 0, "mov $0x#,%eax | ret", "\xb8####\xc3", 6},
{0, 0, "mov $0x#,%ebx | ret", "\xbb####\xc3", 6},
{0, 0, "mov $0x#,%ecx | ret", "\xb9####\xc3", 6},
{0, 0, "mov $0x#,%edx | ret", "\xba####\xc3", 6},
{0, 0, "mov $0x#,%esi | ret", "\xbe####\xc3", 6},
{0, 0, "mov $0x#,%edi | ret", "\xbf####\xc3", 6},
{0, 0, "mov $0x#,%ebp | ret", "\xbd####\xc3", 6},
{0, 0, "mov $0x#,%esp | ret", "\xbc####\xc3", 6},
{0, 0, "mov $0x#,%eax | pop %ebp | ret", "\xb8####\x5d\xc3", 7},
{0, 0, "mov $0x#,%ebx | pop %ebp | ret", "\xbb####\x5d\xc3", 7},
{0, 0, "mov $0x#,%ecx | pop %ebp | ret", "\xb9####\x5d\xc3", 7},
{0, 0, "mov $0x#,%edx | pop %ebp | ret", "\xba####\x5d\xc3", 7},
{0, 0, "mov $0x#,%esi | pop %ebp | ret", "\xbe####\x5d\xc3", 7},
{0, 0, "mov $0x#,%edi | pop %ebp | ret", "\xbf####\x5d\xc3", 7},
{0, 0, "mov $0x#,%ebp | pop %ebp | ret", "\xbd####\x5d\xc3", 7},
{0, 0, "mov $0x#,%esp | pop %ebp | ret", "\xbc####\x5d\xc3", 7},
{0, 0, "xor $0x#,%eax | ret", "\x35####\xc3", 6},
{0, 0, "xor $0x#,%ebx | ret", "\x81\xf3####\xc3", 7},
{0, 0, "xor $0x#,%ecx | ret", "\x81\xf1####\xc3", 7},
{0, 0, "xor $0x#,%edx | ret", "\x81\xf2####\xc3", 7},
{0, 0, "xor $0x#,%esi | ret", "\x81\xf6####\xc3", 7},
{0, 0, "xor $0x#,%edi | ret", "\x81\xf7####\xc3", 7},
{0, 0, "xor $0x#,%eax | pop %ebp | ret", "\x35####\x5d\xc3", 7},
{0, 0, "xor $0x#,%ebx | pop %ebp | ret", "\x81\xf3####\x5d\xc3", 8},
{0, 0, "xor $0x#,%ecx | pop %ebp | ret", "\x81\xf1####\x5d\xc3", 8},
{0, 0, "xor $0x#,%edx | pop %ebp | ret", "\x81\xf2####\x5d\xc3", 8},
{0, 0, "xor $0x#,%esi | pop %ebp | ret", "\x81\xf6####\x5d\xc3", 8},
{0, 0, "xor $0x#,%edi | pop %ebp | ret", "\x81\xf7####\x5d\xc3", 8},
{0, 0, "add $0x#,%eax | ret", "\x05####\xc3", 6},
{0, 0, "add $0x#,%ebx | ret", "\x81\xc3####\xc3", 7},
{0, 0, "add $0x#,%ecx | ret", "\x81\xc1####\xc3", 7},
{0, 0, "add $0x#,%edx | ret", "\x81\xc2####\xc3", 7},
{0, 0, "add $0x#,%esi | ret", "\x81\xc6####\xc3", 7},
{0, 0, "add $0x#,%edi | ret", "\x81\xc7####\xc3", 7},
{0, 0, "add $0x#,%eax | pop %ebp | ret", "\x05####\x5d\xc3", 7},
{0, 0, "add $0x#,%ebx | pop %ebp | ret", "\x81\xc3####\x5d\xc3", 8},
{0, 0, "add $0x#,%ecx | pop %ebp | ret", "\x81\xc1####\x5d\xc3", 8},
{0, 0, "add $0x#,%edx | pop %ebp | ret", "\x81\xc2####\x5d\xc3", 8},
{0, 0, "add $0x#,%esi | pop %ebp | ret", "\x81\xc6####\x5d\xc3", 8},
{0, 0, "add $0x#,%edi | pop %ebp | ret", "\x81\xc7####\x5d\xc3", 8},
{0, 0, "sub $0x#,%eax | ret", "\x2d####\xc3", 6},
{0, 0, "sub $0x#,%ebx | ret", "\x81\xeb####\xc3", 7},
{0, 0, "sub $0x#,%ecx | ret", "\x81\xe9####\xc3", 7},
{0, 0, "sub $0x#,%edx | ret", "\x81\xea####\xc3", 7},
{0, 0, "sub $0x#,%esi | ret", "\x81\xee####\xc3", 7},
{0, 0, "sub $0x#,%edi | ret", "\x81\xef####\xc3", 7},
{0, 0, "sub $0x#,%eax | pop %ebp | ret", "\x2d####\x5d\xc3", 7},
{0, 0, "sub $0x#,%ebx | pop %ebp | ret", "\x81\xeb####\x5d\xc3", 8},
{0, 0, "sub $0x#,%ecx | pop %ebp | ret", "\x81\xe9####\x5d\xc3", 8},
{0, 0, "sub $0x#,%edx | pop %ebp | ret", "\x81\xea####\x5d\xc3", 8},
{0, 0, "sub $0x#,%esi | pop %ebp | ret", "\x81\xee####\x5d\xc3", 8},
{0, 0, "sub $0x#,%edi | pop %ebp | ret", "\x81\xef####\x5d\xc3", 8},
{0, 0, "mov $0x_,%eax | ret", "\xb8____\xc3", 6},
{0, 0, "mov $0x_,%ebx | ret", "\xbb____\xc3", 6},
{0, 0, "mov $0x_,%ecx | ret", "\xb9____\xc3", 6},
{0, 0, "mov $0x_,%edx | ret", "\xba____\xc3", 6},
{0, 0, "mov $0x_,%esi | ret", "\xbe____\xc3", 6},
{0, 0, "mov $0x_,%edi | ret", "\xbf____\xc3", 6},
{0, 0, "mov $0x_,%ebp | ret", "\xbd____\xc3", 6},
{0, 0, "mov $0x_,%esp | ret", "\xbc____\xc3", 6},
{0, 0, "mov $0x_,%eax | pop %ebp | ret", "\xb8____\x5d\xc3", 7},
{0, 0, "mov $0x_,%ebx | pop %ebp | ret", "\xbb____\x5d\xc3", 7},
{0, 0, "mov $0x_,%ecx | pop %ebp | ret", "\xb9____\x5d\xc3", 7},
{0, 0, "mov $0x_,%edx | pop %ebp | ret", "\xba____\x5d\xc3", 7},
{0, 0, "mov $0x_,%esi | pop %ebp | ret", "\xbe____\x5d\xc3", 7},
{0, 0, "mov $0x_,%edi | pop %ebp | ret", "\xbf____\x5d\xc3", 7},
{0, 0, "mov $0x_,%ebp | pop %ebp | ret", "\xbd____\x5d\xc3", 7},
{0, 0, "mov $0x_,%esp | pop %ebp | ret", "\xbc____\x5d\xc3", 7},
{0, 0, "xor $0x_,%eax | ret", "\x35____\xc3", 6},
{0, 0, "xor $0x_,%ebx | ret", "\x81\xf3____\xc3", 7},
{0, 0, "xor $0x_,%ecx | ret", "\x81\xf1____\xc3", 7},
{0, 0, "xor $0x_,%edx | ret", "\x81\xf2____\xc3", 7},
{0, 0, "xor $0x_,%esi | ret", "\x81\xf6____\xc3", 7},
{0, 0, "xor $0x_,%edi | ret", "\x81\xf7____\xc3", 7},
{0, 0, "xor $0x_,%eax | pop %ebp | ret", "\x35____\x5d\xc3", 7},
{0, 0, "xor $0x_,%ebx | pop %ebp | ret", "\x81\xf3____\x5d\xc3", 8},
{0, 0, "xor $0x_,%ecx | pop %ebp | ret", "\x81\xf1____\x5d\xc3", 8},
{0, 0, "xor $0x_,%edx | pop %ebp | ret", "\x81\xf2____\x5d\xc3", 8},
{0, 0, "xor $0x_,%esi | pop %ebp | ret", "\x81\xf6____\x5d\xc3", 8},
{0, 0, "xor $0x_,%edi | pop %ebp | ret", "\x81\xf7____\x5d\xc3", 8},
{0, 0, "add $0x_,%eax | ret", "\x05____\xc3", 6},
{0, 0, "add $0x_,%ebx | ret", "\x81\xc3____\xc3", 7},
{0, 0, "add $0x_,%ecx | ret", "\x81\xc1____\xc3", 7},
{0, 0, "add $0x_,%edx | ret", "\x81\xc2____\xc3", 7},
{0, 0, "add $0x_,%esi | ret", "\x81\xc6____\xc3", 7},
{0, 0, "add $0x_,%edi | ret", "\x81\xc7____\xc3", 7},
{0, 0, "add $0x_,%eax | pop %ebp | ret", "\x05____\x5d\xc3", 7},
{0, 0, "add $0x_,%ebx | pop %ebp | ret", "\x81\xc3____\x5d\xc3", 8},
{0, 0, "add $0x_,%ecx | pop %ebp | ret", "\x81\xc1____\x5d\xc3", 8},
{0, 0, "add $0x_,%edx | pop %ebp | ret", "\x81\xc2____\x5d\xc3", 8},
{0, 0, "add $0x_,%esi | pop %ebp | ret", "\x81\xc6____\x5d\xc3", 8},
{0, 0, "add $0x_,%edi | pop %ebp | ret", "\x81\xc7____\x5d\xc3", 8},
{0, 0, "sub $0x_,%eax | ret", "\x2d____\xc3", 6},
{0, 0, "sub $0x_,%ebx | ret", "\x81\xeb____\xc3", 7},
{0, 0, "sub $0x_,%ecx | ret", "\x81\xe9____\xc3", 7},
{0, 0, "sub $0x_,%edx | ret", "\x81\xea____\xc3", 7},
{0, 0, "sub $0x_,%esi | ret", "\x81\xee____\xc3", 7},
{0, 0, "sub $0x_,%edi | ret", "\x81\xef____\xc3", 7},
{0, 0, "sub $0x_,%eax | pop %ebp | ret", "\x2d____\x5d\xc3", 7},
{0, 0, "sub $0x_,%ebx | pop %ebp | ret", "\x81\xeb____\x5d\xc3", 8},
{0, 0, "sub $0x_,%ecx | pop %ebp | ret", "\x81\xe9____\x5d\xc3", 8},
{0, 0, "sub $0x_,%edx | pop %ebp | ret", "\x81\xea____\x5d\xc3", 8},
{0, 0, "sub $0x_,%esi | pop %ebp | ret", "\x81\xee____\x5d\xc3", 8},
{0, 0, "sub $0x_,%edi | pop %ebp | ret", "\x81\xef____\x5d\xc3", 8},
/* EOF variable opcode */
{0, 0, NULL, NULL, 0}
@@ -561,16 +561,16 @@ void gadget_x8632(unsigned char *data, unsigned int cpt, Elf32_Addr offset, int
if (importsc_mode.flag == 1 && !check_exec_maps(maps_exec, (Elf32_Addr)(cpt + offset)))
save_octet(data, (Elf32_Addr)(cpt + offset));
if(!match((const char *)data, tab_x8632[i].value, tab_x8632[i].size)
if(!match2((const char *)data, tab_x8632[i].value, tab_x8632[i].size)
&& !check_exec_maps(maps_exec, (Elf32_Addr)(cpt + offset)))
{
/* no '?' & no '#' */
/* no '?' & no '_' */
if (!check_interrogation(tab_x8632[i].instruction))
fprintf(stdout, "%s0x%.8x%s: %s%s%s\n", RED, (cpt + offset), ENDC, GREEN, tab_x8632[i].instruction, ENDC);
/* if '?' */
else if (interrogation_or_diese(tab_x8632[i].instruction) == 1)
{
varopins = ret_instruction_interrogation(((Elf32_Addr)pMapElf + cpt), tab_x8632[i].instruction, tab_x8632[i].value);
varopins = ret_instruction_interrogation(((Elf32_Addr)pMapElf + cpt), tab_x8632[i].instruction, tab_x8632[i].value, tab_x8632[i].size);
if (!check_if_varop_was_printed(varopins))
{
fprintf(stdout, "%s0x%.8x%s: %s%s%s\n", RED, (cpt + offset), ENDC, GREEN, varopins, ENDC);
@@ -582,10 +582,10 @@ void gadget_x8632(unsigned char *data, unsigned int cpt, Elf32_Addr offset, int
NbGadFound--;
}
}
/* if '#' */
/* if '_' */
else if (interrogation_or_diese(tab_x8632[i].instruction) == 2)
{
varopins = ret_instruction_diese(((Elf32_Addr)pMapElf + cpt), tab_x8632[i].instruction, tab_x8632[i].value);
varopins = ret_instruction_diese(((Elf32_Addr)pMapElf + cpt), tab_x8632[i].instruction, tab_x8632[i].value, tab_x8632[i].size);
if (!check_if_varop_was_printed(varopins))
{
fprintf(stdout, "%s0x%.8x%s: %s%s%s\n", RED, (cpt + offset), ENDC, GREEN, varopins, ENDC);
@@ -606,7 +606,7 @@ void gadget_x8632(unsigned char *data, unsigned int cpt, Elf32_Addr offset, int
}
}
void x8632(unsigned char *data, unsigned int size_data, t_maps_exec *maps_exec)
void x8632(unsigned char *data, unsigned int size_data, t_maps_exec *maps_exec, t_maps_read *maps_read)
{
int i = 0;
unsigned int cpt = 0;
@@ -617,19 +617,10 @@ void x8632(unsigned char *data, unsigned int size_data, t_maps_exec *maps_exec)
NbGadFound = 0;
pVarop = NULL;
importsc_mode.poctet = NULL;
while(cpt < size_data)
while(cpt < size_data && (int)NbGadFound != limitmode.value && (int)NbTotalGadFound != limitmode.value)
{
i = 0;
if (opcode_mode.flag != 1)
{
while (i <= (int)NB_GADGET)
{
if (pGadgets[i].flag != 1 && !no_filtered(pGadgets[i].instruction) && onlymode(pGadgets[i].instruction))
gadget_x8632(data, cpt, (pElf32_Phdr->p_vaddr - pElf32_Phdr->p_offset), i, maps_exec);
i++;
}
}
else
if (opcode_mode.flag == 1)
{
offset = (pElf32_Phdr->p_vaddr - pElf32_Phdr->p_offset);
if(!search_opcode((const char *)data, (char *)opcode_mode.opcode, opcode_mode.size)
@@ -641,6 +632,26 @@ void x8632(unsigned char *data, unsigned int size_data, t_maps_exec *maps_exec)
NbTotalGadFound++;
}
}
else if (stringmode.flag == 1)
{
offset = (pElf32_Phdr->p_vaddr - pElf32_Phdr->p_offset);
if(!match2((const char *)data, (char *)stringmode.string, stringmode.size)
&& !check_read_maps(maps_read, (Elf32_Addr)(cpt + offset)))
{
fprintf(stdout, "%s0x%.8x%s: \"%s%s%s\"\n", RED, (cpt + offset), ENDC, GREEN, stringmode.string, ENDC);
NbTotalGadFound++;
}
}
else
{
while (i <= (int)NB_GADGET)
{
if (pGadgets[i].flag != 1 && !no_filtered(pGadgets[i].instruction) && onlymode(pGadgets[i].instruction))
gadget_x8632(data, cpt, (pElf32_Phdr->p_vaddr - pElf32_Phdr->p_offset), i, maps_exec);
i++;
}
}
cpt++;
data++;
}
src/how_many_found.c
+5 -3
View File
@@ -18,8 +18,10 @@
void how_many_found()
{
if (opcode_mode.flag != 1)
fprintf(stdout, "\nUnique gadgets found: %s%d%s\n", YELLOW, NbGadFound, ENDC);
else
if (opcode_mode.flag == 1)
fprintf(stdout, "\nTotal opcodes found: %s%d%s\n", YELLOW, NbTotalGadFound, ENDC);
else if (stringmode.flag == 1)
fprintf(stdout, "\nTotal strings found: %s%d%s\n", YELLOW, NbTotalGadFound, ENDC);
else
fprintf(stdout, "\nUnique gadgets found: %s%d%s\n", YELLOW, NbGadFound, ENDC);
}
src/main.c
+15 -1
View File
@@ -16,9 +16,23 @@
#include "ropgadget.h"
int main(__attribute__ ((unused))int argc, char **argv)
{
/*
da_addr_t addr = 0;
da_word_t data = 0x0100a0e1;
da_instr_t instr;
da_instr_args_t args;
da_instr_parse(&instr, data, 1);
da_instr_parse_args(&args, &instr);
da_instr_fprint(stdout, &instr, &args, addr);
printf("\n");
addr += sizeof(da_word_t);
*/
check_v_mode(argv);
check_g_mode(argv);
check_d_mode(argv);
src/return_maps_exec.c
+1
View File
@@ -53,6 +53,7 @@ static int check_exec_flag(Elf32_Word flag)
return (FALSE);
}
/* return linked list with maps exec segment */
t_maps_exec *return_maps_exec(void)
{
src/return_maps_read.c
Executable
+74
View File
@@ -0,0 +1,74 @@
/*
** RopGadget - Dev v3.3
** Jonathan Salwan - http://twitter.com/JonathanSalwan
** http://shell-storm.org
** 2011-10-16
**
** Redistribution and use in source and binary forms, with or without
** modification, are permitted provided that the following conditions
** are met:
** 1. Redistributions of source code must retain the above copyright
** notice, this list of conditions and the following disclaimer.
** 2. Redistributions in binary form must reproduce the above copyright
** notice, this list of conditions and the following disclaimer in the
** documentation and/or other materials provided with the distribution.
*/
#include "ropgadget.h"
/* function for add a new element in linked list | save a read maps */
static t_maps_read *add_maps_read(t_maps_read *old_element, Elf32_Addr addr_start, Elf32_Addr addr_end)
{
t_maps_read *new_element;
new_element = malloc(sizeof(t_maps_read));
if (new_element == NULL)
exit(EXIT_FAILURE);
new_element->addr_start = addr_start;
new_element->addr_end = addr_end;
new_element->next = old_element;
return (new_element);
}
/* free linked list */
void free_add_maps_read(t_maps_read *element)
{
t_maps_read *tmp;
while(element)
{
tmp = element;
element = element->next;
free(tmp);
}
}
/* check if flag have a READ BIT */
static int check_read_flag(Elf32_Word flag)
{
if (flag == 2 || flag == 4 || flag == 5 || flag == 6)
return (TRUE);
else
return (FALSE);
}
/* return linked list with maps read segment */
t_maps_read *return_maps_read(void)
{
int x = 0;
t_maps_read *maps_read;
maps_read = NULL;
while (x != pElf_Header->e_phnum)
{
if (check_read_flag(pElf32_Phdr->p_flags) == TRUE)
maps_read = add_maps_read(maps_read, pElf32_Phdr->p_vaddr, (Elf32_Addr)(pElf32_Phdr->p_vaddr + pElf32_Phdr->p_memsz));
x++;
pElf32_Phdr++;
}
pElf32_Phdr -= x;
return (maps_read);
}
src/ropmaker.c
+23 -1
View File
@@ -29,9 +29,31 @@ int match(const char *s1, const char *s2, size_t n)
start:
while (s1[i] != '\0' && s2[i] != '\0' && n != 0)
{
if (s2[i] == '?' || s2[i] == '#')
if (s2[i] == '?' || s2[i] == '_')
{
i++;
n--;
goto start;
}
if (s1[i] != s2[i])
return (1);
i++;
n--;
}
return (0);
}
int match2(const char *s1, const char *s2, size_t n)
{
int i = 0;
start:
while (n != 0)
{
if (s2[i] == '?' || s2[i] == '_')
{
i++;
n--;
goto start;
}
if (s1[i] != s2[i])
src/search_gadgets.c
+8 -6
View File
@@ -19,28 +19,30 @@
#define LINUX pElf_Header->e_ident[EI_OSABI] == ELFOSABI_NONE
#define FREEBSD pElf_Header->e_ident[EI_OSABI] == ELFOSABI_FREEBSD
#define ELF_F pElf_Header->e_ident[EI_CLASS] == ELFCLASS32
#define PROC pElf_Header->e_machine == EM_386
#define PROC8632 pElf_Header->e_machine == EM_386
void search_gadgets(unsigned char *data, unsigned int size_data)
{
t_maps_exec *maps_exec;
t_maps_exec *maps_exec;
t_maps_read *maps_read;
maps_exec = return_maps_exec();
maps_read = return_maps_read();
fprintf(stdout, "%sGadgets information\n", YELLOW);
fprintf(stdout, "============================================================%s\n", ENDC);
/* Linux/x86-32bits & FreeBSD/x86-32bits*/
if (ELF_F && (LINUX || FREEBSD) && PROC)
x8632(data, size_data, maps_exec);
if (ELF_F && (LINUX || FREEBSD) && PROC8632)
x8632(data, size_data, maps_exec, maps_read);
if (opcode_mode.flag != 1)
if (opcode_mode.flag != 1 && stringmode.flag != 1)
{
fprintf(stdout, "\n\n%sPossible combinations.\n", YELLOW);
fprintf(stdout, "============================================================%s\n\n", ENDC);
ropmaker();
}
free_var_opcode(pVarop);
free_add_maps_exec(maps_exec);
free_add_maps_read(maps_read);
}
src/search_opcode.c
+1 -1
View File
@@ -47,7 +47,7 @@ int search_opcode(const char *s1, const char *s2, size_t n)
start:
while (n != 0)
{
if (s2[i] == '?' || s2[i] == '#')
if (s2[i] == '?' || s2[i] == '_')
{
i++;
goto start;
src/syntax.c
+4 -1
View File
@@ -30,11 +30,12 @@ void syntax(char *str)
fprintf(stderr, " -filter <word> Word filter (research slowed)\n");
fprintf(stderr, " -only <keyword> Keyword research (research slowed)\n");
fprintf(stderr, " -opcode <opcode> Search a specific opcode on exec segment\n");
fprintf(stderr, " -string <string> Search a specific hard string on read segment ('?' any char)\n");
fprintf(stderr, " -asm <instructions> Search a specific instructions on exec segment\n");
fprintf(stderr, " -limit <value> Limit the display of gadgets\n");
fprintf(stderr, " -elfheader Display ELF Header before searching gadgets\n");
fprintf(stderr, " -progheader Display Program Header before searching gadgets\n");
fprintf(stderr, " -sectheader Display Section Header before searching gadgets\n\n");
/*fprintf(stderr, " -allheader Display ELF/Program/Section Header before searching gadgets\n\n");*/
fprintf(stderr, "Ex: %s -g ./smashme.bin -bind -port 8080\n", str);
fprintf(stderr, " %s -g ./smashme.bin -importsc \"\\x6a\\x0b\\x58\\x99\\x52\\x68\\x2f\\x2f\\x73\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x31\\xc9\\xcd\\x80\"\n", str);
@@ -43,6 +44,8 @@ void syntax(char *str)
fprintf(stderr, " %s -g ./smashme.bin -opcode \"\\xcd\\x80\"\n", str);
fprintf(stderr, " %s -g ./smashme.bin -asm \"xor %%eax,%%eax ; ret\"\n", str);
fprintf(stderr, " %s -g ./smashme.bin -asm \"int \\$0x80\"\n", str);
fprintf(stderr, " %s -g ./smashme.bin -string \"main\"\n", str);
fprintf(stderr, " %s -g ./smashme.bin -string \"ma?n\"\n", str);
exit(EXIT_SUCCESS);
src/varop.c
+10 -12
View File
@@ -49,22 +49,20 @@ int check_interrogation(char *str)
{
while (*str != '\0')
{
if (*str == '?' || *str == '#')
if (*str == '?' || *str == '_')
return (1);
str++;
}
return (0);
}
int calc_pos_charany(char *value)
int calc_pos_charany(char *value, int size)
{
int i = 0;
int size;
size = strlen(value);
while (i < size)
{
if (*value == '?' || *value == '#')
if (*value == '?' || *value == '_')
return (i);
i++;
value++;
@@ -72,7 +70,7 @@ int calc_pos_charany(char *value)
return (-1);
}
char *ret_instruction_interrogation(Elf32_Addr offset, char *instruction, char *value)
char *ret_instruction_interrogation(Elf32_Addr offset, char *instruction, char *value, int size)
{
char *gad;
char operande[8] = {0};
@@ -80,7 +78,7 @@ char *ret_instruction_interrogation(Elf32_Addr offset, char *instruction, char *
int i = 0;
int ret;
ret = calc_pos_charany(value);
ret = calc_pos_charany(value, size);
if (ret == -1)
return ("Error instruction with '?'\n");
gad = malloc((strlen(instruction) + 64) * sizeof(char));
@@ -103,7 +101,7 @@ char *ret_instruction_interrogation(Elf32_Addr offset, char *instruction, char *
return (gad);
}
char *ret_instruction_diese(Elf32_Addr offset, char *instruction, char *value)
char *ret_instruction_diese(Elf32_Addr offset, char *instruction, char *value, int size)
{
char *gad;
unsigned char *offset_diese;
@@ -112,16 +110,16 @@ char *ret_instruction_diese(Elf32_Addr offset, char *instruction, char *value)
int i = 0;
int ret;
ret = calc_pos_charany(value);
ret = calc_pos_charany(value, size);
if (ret == -1)
return ("Error instruction with '#'\n");
return ("Error instruction with '_'\n");
gad = malloc((strlen(instruction) + 64) * sizeof(char));
memset(gad, 0x00, (strlen(instruction) + 64) * sizeof(char));
offset_diese = (unsigned char *)(offset + ret);
while (*instruction != '\0')
{
if (*instruction == '#')
if (*instruction == '_')
{
operande[0] = *(offset_diese + 0);
operande[1] = *(offset_diese + 1);
@@ -159,7 +157,7 @@ int interrogation_or_diese(char *instruction)
{
if (*instruction == '?')
return (1);
else if (*instruction == '#')
else if (*instruction == '_')
return (2);
instruction++;
}