diff --git a/Makefile b/Makefile index 9736a6d..d1de956 100644 --- a/Makefile +++ b/Makefile @@ -19,7 +19,7 @@ ## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA ## -DEBUG = yes +DEBUG = no RM = rm -f INCLUDE = ./includes SRC_DIR = ./src @@ -29,7 +29,7 @@ ifeq ($(DEBUG),yes) CFLAGS = -g3 -ggdb -Wextra -Wall -D _BSD_SOURCE -I$(INCLUDE) CC = gcc else - CFLAGS = -W -Wall -ansi -pedantic -D _BSD_SOURCE -I$(INCLUDE) + CFLAGS = -W -Wall -ansi -pedantic -D _BSD_SOURCE -I$(INCLUDE) -O2 CC = gcc endif diff --git a/includes/ropgadget.h b/includes/ropgadget.h index 167c2d4..6de0195 100644 --- a/includes/ropgadget.h +++ b/includes/ropgadget.h @@ -304,7 +304,6 @@ void makecode(t_list_inst *); void makecode_importsc(t_list_inst *, int, char *); /* x86-32bits */ -void gadget_x8632(unsigned char *, unsigned int, Elf32_Addr, int, t_map *); void x8632(unsigned char *, unsigned int, t_map *, t_map *); /* xfunc */ diff --git a/src/display_header.c b/src/display_header.c index bf3c398..9877cee 100644 --- a/src/display_header.c +++ b/src/display_header.c @@ -94,7 +94,7 @@ void display_program_header() void display_section_header(void) { - char *ptrNameSection; + char *ptrNameSection = NULL; int x = 0; while(x != pElf_Header->e_shnum) diff --git a/src/filter.c b/src/filter.c index 883a671..7613995 100644 --- a/src/filter.c +++ b/src/filter.c @@ -24,16 +24,14 @@ int filter(char *instruction, t_filter_mode *mode) { t_word_linked *tmp; - char *tmpi; if (mode->flag == 0) return -1; /* every substring in instruction against every filter. */ for (tmp = mode->linked; tmp != NULL; tmp = tmp->next) - for (tmpi = instruction; *tmpi != '\0'; tmpi++) - if (!strncmp(tmpi, tmp->word, strlen(tmp->word))) - return 1; + if (strstr(instruction, tmp->word)) + return 1; return 0; } diff --git a/src/gadget_x8632.c b/src/gadget_x8632.c index 4e123d4..7f1d672 100644 --- a/src/gadget_x8632.c +++ b/src/gadget_x8632.c @@ -22,26 +22,24 @@ #include "ropgadget.h" #include "x8632.h" -void gadget_x8632(unsigned char *data, unsigned int cpt, Elf32_Addr offset, int i, t_map *maps_exec) +static void gadget_x8632(unsigned char *data, unsigned int cpt, Elf32_Addr offset, int i) { char *varopins = NULL; char *syntax = NULL; - /* set display syntax */ - if (syntaxins == INTEL) - syntax = tab_x8632[i].instruction_intel; - else - syntax = tab_x8632[i].instruction; + syntax = (syntaxins == INTEL)?tab_x8632[i].instruction_intel:tab_x8632[i].instruction; - if (importsc_mode.flag == 1 && !check_maps(maps_exec, (Elf32_Addr)(cpt + offset))) + if (importsc_mode.flag == 1) save_octet(data, (Elf32_Addr)(cpt + offset)); - if(!match2((const char *)data, tab_x8632[i].value, tab_x8632[i].size) - && !check_maps(maps_exec, (Elf32_Addr)(cpt + offset))) + if(!match2((const char *)data, tab_x8632[i].value, tab_x8632[i].size)) { /* no '?' & no '#' */ if (!check_interrogation(syntax)) - fprintf(stdout, "%s0x%.8x%s: %s%s%s\n", RED, (cpt + offset), ENDC, GREEN, syntax, ENDC); + { + fprintf(stdout, "%s0x%.8x%s: %s%s%s\n", RED, (cpt + offset), ENDC, GREEN, syntax, ENDC); + tab_x8632[i].flag = 1; + } /* if '?' or '#' */ else { @@ -52,15 +50,10 @@ void gadget_x8632(unsigned char *data, unsigned int cpt, Elf32_Addr offset, int pVarop = add_element(pVarop, varopins, (cpt + offset)); } else - { - free(varopins); - NbGadFound--; - } + NbGadFound--; free(varopins); } - if (!check_interrogation(syntax)) - tab_x8632[i].flag = 1; tab_x8632[i].addr = (Elf32_Addr)(cpt + offset); NbGadFound++; NbTotalGadFound++; @@ -69,10 +62,11 @@ void gadget_x8632(unsigned char *data, unsigned int cpt, Elf32_Addr offset, int void x8632(unsigned char *data, unsigned int size_data, t_map *maps_exec, t_map *maps_read) { - int i = 0; + int i; unsigned int cpt = 0; Elf32_Addr offset; char *real_string; + char *inst_tmp; pGadgets = tab_x8632; NbTotalGadFound = 0; @@ -81,14 +75,27 @@ void x8632(unsigned char *data, unsigned int size_data, t_map *maps_exec, t_map importsc_mode.poctet = NULL; offset = (pElf32_Phdr->p_vaddr - pElf32_Phdr->p_offset); /* base addr */ cpt = set_cpt_if_mapmode(cpt); /* mapmode */ + + /* If we're in simple gadget mode, precompute which instructions to search */ + if (opcode_mode.flag != 1 && stringmode.flag != 1) + { + for (i = 0; i < (int)NB_GADGET; i++) + { + inst_tmp = (syntaxins == INTEL)?pGadgets[i].instruction_intel:pGadgets[i].instruction; + if (!(filter(inst_tmp, &filter_mode) <=0 && filter(inst_tmp, &only_mode))) + pGadgets[i].flag = -1; + } + } + + while(cpt < size_data && (int)NbGadFound != limitmode.value && (int)NbTotalGadFound != limitmode.value && !check_end_mapmode(cpt)) { - i = 0; + if (check_maps(stringmode.flag?maps_read:maps_exec, (Elf32_Addr)(cpt + offset))) + continue; /* opcode mode */ - if (opcode_mode.flag == 1) + if (opcode_mode.flag) { - if(!search_opcode((const char *)data, (char *)opcode_mode.opcode, opcode_mode.size) - && !check_maps(maps_exec, (Elf32_Addr)(cpt + offset))) + if(!search_opcode((const char *)data, (char *)opcode_mode.opcode, opcode_mode.size)) { fprintf(stdout, "%s0x%.8x%s: \"%s", RED, (cpt + offset), ENDC, GREEN); print_opcode(); @@ -97,10 +104,9 @@ void x8632(unsigned char *data, unsigned int size_data, t_map *maps_exec, t_map } } /* string mode */ - else if (stringmode.flag == 1) + else if (stringmode.flag) { - if(!match2((const char *)data, (char *)stringmode.string, strlen(stringmode.string)) - && !check_maps(maps_read, (Elf32_Addr)(cpt + offset))) + if(!match2((const char *)data, (char *)stringmode.string, strlen(stringmode.string))) { real_string = real_string_stringmode(stringmode.string, data); fprintf(stdout, "%s0x%.8x%s: \"%s", RED, (cpt + offset), ENDC, GREEN); @@ -113,19 +119,11 @@ void x8632(unsigned char *data, unsigned int size_data, t_map *maps_exec, t_map /* simple gadget mode */ else { - while (i < (int)NB_GADGET) + for (i = 0; i < (int)NB_GADGET; i++) { - if (syntaxins == INTEL) - { - if (pGadgets[i].flag != 1 && filter(pGadgets[i].instruction_intel, &filter_mode) <=0 && filter(pGadgets[i].instruction_intel, &only_mode)) - gadget_x8632(data, cpt, offset, i, maps_exec); - } - else - { - if (pGadgets[i].flag != 1 && filter(pGadgets[i].instruction, &filter_mode) <= 0 && filter(pGadgets[i].instruction, &only_mode)) - gadget_x8632(data, cpt, offset, i, maps_exec); - } - i++; + if (pGadgets[i].flag != 0) + continue; + gadget_x8632(data, cpt, offset, i); } } diff --git a/src/main.c b/src/main.c index 1ec0442..1f6d432 100644 --- a/src/main.c +++ b/src/main.c @@ -205,6 +205,11 @@ int main(int argc, char **argv) { exit(EXIT_FAILURE); } + if (stringmode.flag && opcode_mode.flag) { + fprintf(stderr, "\t%sError. Don't set a -string flag with -opcode%s\n", RED, ENDC); + exit(EXIT_FAILURE); + } + process_filemode(file); check_elf_format(filemode.data); check_arch_supported(); @@ -227,15 +232,8 @@ int main(int argc, char **argv) { if (asm_mode.flag) build_code(asm_mode.argument); - if (flag_g) { + if (flag_g) search_gadgets(filemode.data, filemode.size); - if (opcode_mode.flag == 1) - fprintf(stdout, "\nTotal opcodes found: %s%d%s\n", YELLOW, NbTotalGadFound, ENDC); - else if (stringmode.flag == 1) - fprintf(stdout, "\nTotal strings found: %s%d%s\n", YELLOW, NbTotalGadFound, ENDC); - else - fprintf(stdout, "\nUnique gadgets found: %s%d%s\n", YELLOW, NbGadFound, ENDC); - } if (flag_sectheader == 0 && flag_progheader == 0 && flag_elfheader == 0 && flag_symtab == 0 && flag_g == 0) diff --git a/src/makecode.c b/src/makecode.c index 236fca7..9f5ca08 100644 --- a/src/makecode.c +++ b/src/makecode.c @@ -54,8 +54,8 @@ void free_list_inst(t_list_inst *element) { tmp = element; element = tmp->next; - free(tmp); free(tmp->instruction); + free(tmp); } } @@ -284,6 +284,9 @@ static void makepartie1(t_list_inst *list_ins, int local) } else { + char opts[9] = {0}; + int offsets[] = {0, 17, 26, -1}; + fprintf(stdout, "\t\t%s# execve /bin/sh bindport %d generated by RopGadget v3.4.2%s\n", BLUE, bind_mode.port, ENDC); print_string("//usr/bin/netcat", @@ -292,7 +295,6 @@ static void makepartie1(t_list_inst *list_ins, int local) addr_mov_gadget, mov_gadget, addr_xor_gadget, xor_gadget, 0); - char opts[9] = {0}; sprintf(opts, "-ltp%d", bind_mode.port); print_string(opts, @@ -307,8 +309,6 @@ static void makepartie1(t_list_inst *list_ins, int local) addr_mov_gadget, mov_gadget, addr_xor_gadget, xor_gadget, 26); - int offsets[] = {0, 17, 26, -1}; - print_vector(&offsets[0], addr_pop_stack_gadget, pop_stack_gadget, reg_stack, addr_pop_binsh_gadget, pop_binsh_gadget, reg_binsh, @@ -402,7 +402,7 @@ static int check_opcode_was_found(void) if (!importsc_mode.poctet) return FALSE; - for (; importsc_mode.poctet->next != NULL; importsc_mode.poctet = importsc_mode.poctet->next) + for (i = 0; importsc_mode.poctet->next != NULL; importsc_mode.poctet = importsc_mode.poctet->next) i++; return (i == importsc_mode.size - 1); diff --git a/src/save_section.c b/src/save_section.c index 18a5fca..b5c1c43 100644 --- a/src/save_section.c +++ b/src/save_section.c @@ -68,7 +68,7 @@ static void save_info_section_ropmaker(void) void save_section(void) { int x = 0; - char *ptrNameSection; + char *ptrNameSection = NULL; list_section = NULL; while(x != pElf_Header->e_shnum) diff --git a/src/search_gadgets.c b/src/search_gadgets.c index 3fc3455..275fd8e 100644 --- a/src/search_gadgets.c +++ b/src/search_gadgets.c @@ -45,4 +45,11 @@ void search_gadgets(unsigned char *data, unsigned int size_data) free_list_inst(pVarop); free_add_map(maps_exec); free_add_map(maps_read); + + if (opcode_mode.flag == 1) + fprintf(stdout, "\nTotal opcodes found: %s%d%s\n", YELLOW, NbTotalGadFound, ENDC); + else if (stringmode.flag == 1) + fprintf(stdout, "\nTotal strings found: %s%d%s\n", YELLOW, NbTotalGadFound, ENDC); + else + fprintf(stdout, "\nUnique gadgets found: %s%d%s\n", YELLOW, NbGadFound, ENDC); }