Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

QUESTION: auto ROP chain generation #184

Open
init5-SF opened this issue Sep 12, 2022 · 1 comment
Open

QUESTION: auto ROP chain generation #184

init5-SF opened this issue Sep 12, 2022 · 1 comment

Comments

@init5-SF
Copy link

hello, I have a question (might sound noob, I know)

but, why does ROPGadget successfully create the python code of the ROP chain sometimes, and some other times it doesnt?
And when it doesn't, what's the alternative? Can it be configured to look for the gadgets it needs elsewhere (like libc)?

@SweetVishnya
Copy link
Collaborator

ROPgadget has a pretty straightforward ROP chain generation algorithm. It just searches for some exact opcodes and chains them together. ROPgadget is mainly a gadget finding tool.

There are some more advanced tools for facilitating ROP chaining [1]. You'd better try them. We actually wrote a nice survey about different ROP chaining methods and tools [2].

However, ROPgadget is still a great tool for finding complicated gadgets. Moreover, ROPgadget is used by some ROP compilers as a ROP gadget search engine.

P.S. ROPgadget is able to search for gadgets in libc just like in any other --binary.

[1] https://github.com/ispras/rop-benchmark#supported-tools
[2] https://arxiv.org/abs/2011.07862

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants