Tom Samstag 966c1e2ed6 Fixing offsets with execve syscall ...

The shellcode generated for the Ubuntu 64b libc in Python format ends
with:
p += pack("<Q", off + 0x0000000000023950) # pop rax ; ret
p += pack("<Q", off + 0x000000000000003b) #  execve
p += pack("<Q", off + 0x0000000000001454) # syscall

Notice the offset being incorrectly added to the 3b literal for the
execve syscall. This results in nonfunctioning shell code. This patch
fixes that by:
1) Changing sc_print_addr_pop to sc_print_number_pop. The function is
only used once, and it's to print a numeric literal, not an address.
Popping a numeric literal should not add the library offset.
2) Adding a parameter to sc_print_code to dictate whether the value is
in the library and thus should be offset if a shared object.

With the patch applied, the resulting shell code for the same invocation
as above correctly ends in:
p += pack("<Q", off + 0x0000000000023950) # pop rax ; ret
p += pack("<Q", 0x000000000000003b) #  execve
p += pack("<Q", off + 0x0000000000001454) # syscall

2013-06-18 15:26:22 -07:00

..

ropgadget.h

Fixing offsets with execve syscall

2013-06-18 15:26:22 -07:00