mirror of
https://github.com/JonathanSalwan/ROPgadget
synced 2026-06-08 11:25:23 +00:00
JonathanSalwan
137 lines
6.9 KiB
Python
137 lines
6.9 KiB
Python
#!/usr/bin/env python2
|
|
## -*- coding: utf-8 -*-
|
|
##
|
|
## Jonathan Salwan - 2014-05-12 - ROPgadget tool
|
|
##
|
|
## http://twitter.com/JonathanSalwan
|
|
## http://shell-storm.org/project/ROPgadget/
|
|
##
|
|
## This program is free software: you can redistribute it and/or modify
|
|
## it under the terms of the GNU General Public License as published by
|
|
## the Free Software Foundation, either version 3 of the License, or
|
|
## (at your option) any later version.
|
|
|
|
import argparse
|
|
import sys
|
|
|
|
from updateAlert import UpdateAlert
|
|
from version import *
|
|
|
|
class Args:
|
|
def __init__(self):
|
|
self.__args = None
|
|
self.__parse()
|
|
|
|
def __parse(self):
|
|
parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter,
|
|
description="""description:
|
|
ROPgadget lets you search your gadgets on a binary. It supports several
|
|
file formats and architectures and uses the Capstone disassembler for
|
|
the search engine.
|
|
|
|
formats supported:
|
|
- ELF
|
|
- PE
|
|
- Mach-O
|
|
- Raw
|
|
|
|
architectures supported:
|
|
- x86
|
|
- x86-64
|
|
- ARM
|
|
- ARM64
|
|
- MIPS
|
|
- PowerPC
|
|
- Sparc
|
|
""",
|
|
epilog="""console commands:
|
|
count Display the number of gadgets loaded
|
|
badbytes Rejects specific bytes in the gadget's address
|
|
depth Set the depth search engine
|
|
display Display all gadgets
|
|
help Display the help
|
|
load Load all gadgets
|
|
quit Quit the console mode
|
|
search Search specific keywords or not
|
|
|
|
examples:
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --ropchain
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --depth 3
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --string "main"
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --string "m..n"
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --opcode c9c3
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --only "mov|ret"
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --only "mov|pop|xor|ret"
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --filter "xchg|add|sub"
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --norop --nosys
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --range 0x08041000-0x08042000
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --string main --range 0x080c9aaa-0x080c9aba
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --memstr "/bin/sh"
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --console
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --badbytes "00|7f|42"
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-Linux-x86 --badbytes "a|b|c|d|e|f"
|
|
ROPgadget.py --binary ./test-suite-binaries/Linux_lib64.so --offset 0xdeadbeef00000000
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-ARMv7-ls --depth 5
|
|
ROPgadget.py --binary ./test-suite-binaries/elf-ARM64-bash --depth 5
|
|
ROPgadget.py --binary ./test-suite-binaries/raw-x86.raw --rawArch=x86 --rawMode=32""")
|
|
|
|
parser.add_argument("-v", "--version", action="store_true", help="Display the ROPgadget's version")
|
|
parser.add_argument("-c", "--checkUpdate", action="store_true", help="Checks if a new version is available")
|
|
parser.add_argument("--binary", type=str, metavar="<binary>", help="Specify a binary filename to analyze")
|
|
parser.add_argument("--opcode", type=str, metavar="<opcodes>", help="Searh opcode in executable segment")
|
|
parser.add_argument("--string", type=str, metavar="<string>", help="Search string in readable segment")
|
|
parser.add_argument("--memstr", type=str, metavar="<string>", help="Search each byte in all readable segment")
|
|
parser.add_argument("--depth", type=int, metavar="<nbyte>", default=10, help="Depth for search engine (default 10)")
|
|
parser.add_argument("--only", type=str, metavar="<key>", help="Only show specific instructions")
|
|
parser.add_argument("--filter", type=str, metavar="<key>", help="Suppress specific instructions")
|
|
parser.add_argument("--range", type=str, metavar="<start-end>", default="0x0-0x0", help="Search between two addresses (0x...-0x...)")
|
|
parser.add_argument("--badbytes", type=str, metavar="<byte>", help="Rejects specific bytes in the gadget's address")
|
|
parser.add_argument("--rawArch", type=str, metavar="<arch>", help="Specify an arch for a raw file")
|
|
parser.add_argument("--rawMode", type=str, metavar="<mode>", help="Specify a mode for a raw file")
|
|
parser.add_argument("--offset", type=str, metavar="<hexaddr>", help="Specify an offset for gadget addresses")
|
|
parser.add_argument("--ropchain", action="store_true", help="Enable the ROP chain generation")
|
|
parser.add_argument("--thumb" , action="store_true", help="Use the thumb mode for the search engine (ARM only)")
|
|
parser.add_argument("--console", action="store_true", help="Use an interactive console for search engine")
|
|
parser.add_argument("--norop", action="store_true", help="Disable ROP search engine")
|
|
parser.add_argument("--nojop", action="store_true", help="Disable JOP search engine")
|
|
parser.add_argument("--nosys", action="store_true", help="Disable SYS search engine")
|
|
self.__args = parser.parse_args()
|
|
|
|
if self.__args.version:
|
|
self.__printVersion()
|
|
sys.exit(0)
|
|
|
|
elif self.__args.checkUpdate:
|
|
UpdateAlert().checkUpdate()
|
|
sys.exit(0)
|
|
|
|
elif self.__args.depth < 2:
|
|
print "[Error] The depth must be >= 2"
|
|
sys.exit(-1)
|
|
|
|
elif not self.__args.binary:
|
|
print "[Error] Need a binary filename (--binary or --help)"
|
|
sys.exit(-1)
|
|
|
|
elif self.__args.range:
|
|
try:
|
|
rangeS = int(self.__args.range.split('-')[0], 16)
|
|
rangeE = int(self.__args.range.split('-')[1], 16)
|
|
except:
|
|
print "[Error] A range must be set in hexadecimal. Ex: 0x08041000-0x08042000"
|
|
sys.exit(-1)
|
|
if rangeS > rangeE:
|
|
print "[Error] The start value must be greater than end value"
|
|
sys.exit(-1)
|
|
|
|
def __printVersion(self):
|
|
print "Version: %s" %(PYROPGADGET_VERSION)
|
|
print "Author: Jonathan Salwan"
|
|
print "Author page: https://twitter.com/JonathanSalwan"
|
|
print "Project page: http://shell-storm.org/project/ROPgadget/"
|
|
|
|
def getArgs(self):
|
|
return self.__args
|
|
|