ROPgadget bug with `jmp` instruction
farazsth98 opened this issue · 2 comments
farazsth98 commented
Hello.
There seems to be some bug with the latest version of ROPgadget (version 6.4). I'm not sure what exactly the bug is but I will show you its impact.
The binary I was testing with can be found here: https://github.com/sajjadium/CTFium/blob/master/pbctf/2020/Pwnception/challenge/userland
Essentially, when running ROPgadget on this binary, you see the following gadget at 0x4009d3
:
$ ROPgadget --binary ./userland | grep 4009d3
0x00000000004009d3 : mov rdi, rax ; jmp 0x400ca3
However, this is actually incorrect. As shown below, the actual gadget is as follows:
$ objdump -d ./userland -M intel | grep 4009d3 -A1
4009d3: 48 89 c7 mov rdi,rax
4009d6: e9 c5 02 00 00 jmp 0x400ca0
This is an issue as it can cause someone to think a gadget is useless when in fact it's not.
SweetVishnya commented
Thank you for the feedback, I will try to fix it. Seems like ROPgadget gives the wrong address to disassembler.
SweetVishnya commented
Fixed it, thx.