Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot Find some Gadgets because of disassemble error ! #156

Open
ZoEplA opened this issue Apr 14, 2022 · 3 comments
Open

Cannot Find some Gadgets because of disassemble error ! #156

ZoEplA opened this issue Apr 14, 2022 · 3 comments

Comments

@ZoEplA
Copy link

ZoEplA commented Apr 14, 2022

When I compared Ropper and Angrop, I unexpectedly found that There were some gadgets in Angrop that Ropper could not find. The reason was caused by disassembly error in __createGadget function in ropper/ropper/rop.py

But it is normal to call the disassembleAddress interface for disassembly. After a simple debugging, I found that the disassembler.disasm() parameter in the __createGadget function is inconsistent with the disassembler.disasm() parameter in the disassembleAddress function.

This may be the cause of partial disassembly failures

testcase:
in the binary of libc.so.6(x86);version is 2.31

GNU C Library (Ubuntu GLIBC 2.31-0ubuntu9.7) stable release version 2.31.
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC version 9.3.0.
libc ABIs: UNIQUE IFUNC ABSOLUTE
For bug reporting instructions, please see:
<https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
ipdb> for i in disassembler.disasm(b'\r\xc3', 1474192):
    print("test")

ipdb> for i in disassembler.disasm(b'\x83\xc0\r\xc3', 1474192):
    print("test")

test
test
$ ropper -f libc.so.6_x86 --disassemble-address 0x167e92:L2



Instructions
============


0x0014ee92: or eax, 0xec083c3
0x0014ee97: ret

0x0014ee92 this gadget can't be found using Ropper, but there are other gadgets out there, just to give you an example.

maybe this is useful to you!

ipdb> for a in disassembler.disasm(b'\r\xc3\x83\xc0\x0e\xc3',0x167e92):
    print("test")

test
test
ipdb> code_str
b'\r\xc3'
ipdb> for a in disassembler.disasm(b'\r\xc3',0x167e92):
    print("test")
@sashs
Copy link
Owner

sashs commented Aug 7, 2022

Hey. Apologize the delay, can you provide the binary?

@ZoEplA
Copy link
Author

ZoEplA commented Sep 13, 2022

libc.so.6_x86.zip
here is the binary file.

@ZoEplA
Copy link
Author

ZoEplA commented Sep 13, 2022

Sorry, didn't notice your reply message

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants