Skip to content

Commit

Permalink
Fix message for execve syscall in x86_64.
Browse files Browse the repository at this point in the history
Also use hex-formatted index in the ropchain generator to be more
consistent with the x86 generator (this is not a functional
change).
  • Loading branch information
jakelamberson committed Jun 26, 2024
1 parent 85e0379 commit 77b88b4
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions ropper/ropchain/arch/ropchainx86_64.py
Original file line number Diff line number Diff line change
Expand Up @@ -652,7 +652,7 @@ def create(self, options):
raise RopChainError('No argument support for execve commands')

self._printMessage('ROPchain Generator for syscall execve:\n')
self._printMessage('\nwrite command into data section\nrax 0xb\nrdi address to cmd\nrsi address to null\nrdx address to null\n')
self._printMessage('\nwrite command into data section\nrax 0x3b\nrdi address to cmd\nrsi address to null\nrdx address to null\n')
chain = self._printHeader()
gadgets = []
can_create_command = False
Expand Down Expand Up @@ -689,7 +689,7 @@ def create(self, options):
gadgets.append((self._createAddress, [cmdaddress],{'reg':'rdi'},['rdi','edi', 'di']))
gadgets.append((self._createAddress, [nulladdress],{'reg':'rsi'},['rsi','esi', 'si']))
gadgets.append((self._createAddress, [nulladdress],{'reg':'rdx'},['rdx','edx', 'dx', 'dl', 'dh']))
gadgets.append((self._createNumber, [59],{'reg':'rax'},['rax','eax', 'ax', 'al', 'ah']))
gadgets.append((self._createNumber, [0x3b],{'reg':'rax'},['rax','eax', 'ax', 'al', 'ah']))
if address is not None and not can_create_command:
if type(address) is str:
cmdaddress = int(address, 16)
Expand All @@ -704,7 +704,7 @@ def create(self, options):
gadgets.append((self._createNumber, [cmdaddress],{'reg':'rdi'},['rdi','edi', 'di']))
gadgets.append((self._createNumber, [nulladdress],{'reg':'rsi'},['rsi','esi', 'si']))
gadgets.append((self._createNumber, [nulladdress],{'reg':'rdx'},['rdx','edx', 'dx', 'dl', 'dh']))
gadgets.append((self._createNumber, [59],{'reg':'rax'},['rax','eax', 'ax', 'al', 'ah']))
gadgets.append((self._createNumber, [0x3b],{'reg':'rax'},['rax','eax', 'ax', 'al', 'ah']))

self._printMessage('Try to create chain which fills registers without delete content of previous filled registers')
chain_tmp += self._createDependenceChain(gadgets)
Expand Down

0 comments on commit 77b88b4

Please sign in to comment.