You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When a function ends with a switch statement you often see a lot of jumps to a static address that then just returns.
Below is an example of this pattern.
Ropper misses these gadgets, I'm assuming because the search doesn't follow forward edges.
Even when using very permissive search results it doesn't find these gadgets.
Here are the example code I used to generate the test binary and the command I ran to check for gadgets.
Compiling and checking for ret type gadgets that start with mov only finds the last switch case and the mov from [rbp-8] to eax but doesn't find all other integer moves into [rbp-8}
When a function ends with a switch statement you often see a lot of jumps to a static address that then just returns.
Below is an example of this pattern.
Ropper misses these gadgets, I'm assuming because the search doesn't follow forward edges.
Even when using very permissive search results it doesn't find these gadgets.
Here are the example code I used to generate the test binary and the command I ran to check for gadgets.
Compiling and checking for
ret
type gadgets that start withmov
only finds the last switch case and themov
from[rbp-8]
toeax
but doesn't find all other integer moves into[rbp-8}
The text was updated successfully, but these errors were encountered: