syscall gadgets missed for x86-64
tezeb opened this issue · comments
During recent Hitcon Quals, I've noticed that gadgets ending with syscall
are not found. It does not work even with version 5.4
which is supposed to support it(#66).
$ ROPgadget --version
Version: ROPgadget v5.4
Author: Jonathan Salwan
Author page: https://twitter.com/JonathanSalwan
Project page: http://shell-storm.org/project/ROPgadget/
$ ROPgadget --binary vdso.dump | grep syscall
$
Running objump on the binary:
$ objdump -Mintel -D vdso.dump | grep -B 1 syscall
b5b: b8 e4 00 00 00 mov eax,0xe4
b60: 0f 05 syscall
--
edb: 4c 89 df mov rdi,r11
ede: 0f 05 syscall
$
It does not work regardless of Elf/raw mode.
Attached is vdso.so (base64 encoded):
I think this is because syscall isn't considered a jump, so only syscall-ret gadgets are detected. This should be fixed because syscalls don't always return.