JonathanSalwan / ROPgadget

This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.

Home Page:http://www.shell-storm.org/project/ROPgadget/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

ROPgadget bug with `jmp` instruction

farazsth98 opened this issue · comments

commented

Hello.

There seems to be some bug with the latest version of ROPgadget (version 6.4). I'm not sure what exactly the bug is but I will show you its impact.

The binary I was testing with can be found here: https://github.com/sajjadium/CTFium/blob/master/pbctf/2020/Pwnception/challenge/userland

Essentially, when running ROPgadget on this binary, you see the following gadget at 0x4009d3:

$ ROPgadget --binary ./userland | grep 4009d3
0x00000000004009d3 : mov rdi, rax ; jmp 0x400ca3

However, this is actually incorrect. As shown below, the actual gadget is as follows:

$ objdump -d ./userland -M intel | grep 4009d3 -A1
  4009d3:	48 89 c7             	mov    rdi,rax
  4009d6:	e9 c5 02 00 00       	jmp    0x400ca0

This is an issue as it can cause someone to think a gadget is useless when in fact it's not.

Thank you for the feedback, I will try to fix it. Seems like ROPgadget gives the wrong address to disassembler.

Fixed it, thx.