QUESTION: auto ROP chain generation
init5-SF opened this issue · 1 comments
hello, I have a question (might sound noob, I know)
but, why does ROPGadget successfully create the python code of the ROP chain sometimes, and some other times it doesnt?
And when it doesn't, what's the alternative? Can it be configured to look for the gadgets it needs elsewhere (like libc)?
ROPgadget has a pretty straightforward ROP chain generation algorithm. It just searches for some exact opcodes and chains them together. ROPgadget is mainly a gadget finding tool.
There are some more advanced tools for facilitating ROP chaining [1]. You'd better try them. We actually wrote a nice survey about different ROP chaining methods and tools [2].
However, ROPgadget is still a great tool for finding complicated gadgets. Moreover, ROPgadget is used by some ROP compilers as a ROP gadget search engine.
P.S. ROPgadget is able to search for gadgets in libc just like in any other --binary.
[1] https://github.com/ispras/rop-benchmark#supported-tools
[2] https://arxiv.org/abs/2011.07862