get wrong offset of a string, what happened to you?...

bug binary file

bug screenshot here: https://ptpb.pw/aG2O

FWIW this only breaks on python3 for some reason. I'll have a look.

This is a compatibility issue with python 3 bytes and string.

ROPgadget/ropgadget/core.py

Line 97 in 0dc14e7

allRef = [m.start() for m in re.finditer(string, section["opcodes"])]

section["opcodes"] was casted as str in

ROPgadget/ropgadget/loaders/elf.py

Line 311 in 0dc14e7

    
           "opcodes" : str(self.__binary[section.sh_offset:section.sh_offset+section.sh_size])

This casting is incorrect and the bytes get malformed to something like

bytearray(b'\x03\x00\x00\..

This is not the representation of the string but the actual string so...

with this patch this worked

diff --git a/ropgadget/core.py b/ropgadget/core.py
index d1e6527..9934185 100644
--- a/ropgadget/core.py
+++ b/ropgadget/core.py
@@ -94,7 +94,7 @@ class Core(cmd.Cmd):
         arch = self.__binary.getArchMode()
         print("Strings information\n============================================================")
         for section in dataSections:
-            allRef = [m.start() for m in re.finditer(string, section["opcodes"])]
+            allRef = [m.start() for m in re.finditer(b"/bin/sh", section["opcodes"])]
             for ref in allRef:
                 vaddr  = self.__offset + section["vaddr"] + ref
                 string = section["opcodes"][ref:ref+len(string)]
diff --git a/ropgadget/loaders/elf.py b/ropgadget/loaders/elf.py
index d96f42d..aa1a88e 100644
--- a/ropgadget/loaders/elf.py
+++ b/ropgadget/loaders/elf.py
@@ -308,7 +308,7 @@ class ELF(object):
                             "offset"  : section.sh_offset,
                             "size"    : section.sh_size,
                             "vaddr"   : section.sh_addr,
-                            "opcodes" : str(self.__binary[section.sh_offset:section.sh_offset+section.sh_size])
+                            "opcodes" : self.__binary[section.sh_offset:section.sh_offset+section.sh_size]
                         }]
         return ret

Can you please provide a PR?

Yes, sure. I already have working version, just verifying with tests.