[Feature Request] Allow overriding the default base address

[captainGeech42]

It would be useful when working with binaries that have a randomized base address via ASLR to be able to override the default base address being used, either arbitrarily or to just set it to 0. This eliminates a step of having to subtract the base address manually to get the VA offset to a gadget.

This is different from --offset, which just applies a slide to the address of an outputted gadget, but doesn't actually affect the address at which it is disassembled (see below for examples)

[SweetVishnya]

Have you tried --offset option?

[captainGeech42]

@SweetVishnya yes, maybe its a bug that it doesn't work on PE files, I haven't used that argument before

$ alias rop
rop='ROPgadget --binary'

$ rop ntoskrnl.exe --offset 0 | head -10
Gadgets information
============================================================
0x0000000140453627 : adc ah, 0xe3 ; jmp qword ptr [rsi + 0x39]
0x0000000140932d26 : adc ah, 4 ; add byte ptr [rax], al ; mov dword ptr [rbp - 0x30], eax ; jmp 0x140932d34
0x000000014079340a : adc ah, ah ; add al, byte ptr [rax] ; jmp 0x140793417
0x00000001405c5afc : adc ah, ah ; dec dword ptr [rax - 0x75] ; iretd
0x00000001407fb596 : adc ah, ah ; dec dword ptr [rax - 0x7d] ; loope 0x1407fb59b ; jmp 0x14063c7dc
0x0000000140843da2 : adc ah, ah ; dec dword ptr [rbx + 0x2dd3e9c6] ; jmp 0x140843dab
0x000000014040cc79 : adc ah, al ; call qword ptr [rax + 0x20c48348]
0x00000001407ce458 : adc ah, al ; dec dword ptr [rdi] ; mov edx, 0x338910fe ; jmp 0x1405cf61f

$ rop ntoskrnl.exe | head -10
Gadgets information
============================================================
0x0000000140453627 : adc ah, 0xe3 ; jmp qword ptr [rsi + 0x39]
0x0000000140932d26 : adc ah, 4 ; add byte ptr [rax], al ; mov dword ptr [rbp - 0x30], eax ; jmp 0x140932d34
0x000000014079340a : adc ah, ah ; add al, byte ptr [rax] ; jmp 0x140793417
0x00000001405c5afc : adc ah, ah ; dec dword ptr [rax - 0x75] ; iretd
0x00000001407fb596 : adc ah, ah ; dec dword ptr [rax - 0x7d] ; loope 0x1407fb59b ; jmp 0x14063c7dc
0x0000000140843da2 : adc ah, ah ; dec dword ptr [rbx + 0x2dd3e9c6] ; jmp 0x140843dab
0x000000014040cc79 : adc ah, al ; call qword ptr [rax + 0x20c48348]
0x00000001407ce458 : adc ah, al ; dec dword ptr [rdi] ; mov edx, 0x338910fe ; jmp 0x1405cf61f

[captainGeech42]

$ ROPgadget -v
Version:        ROPgadget v7.6
Author:         Jonathan Salwan
Author page:    https://twitter.com/JonathanSalwan
Project page:   http://shell-storm.org/project/ROPgadget/

$ ROPgadget -c
Your version is up-to-date.

[captainGeech42]

ah yea that does look like the root cause, the flag is doing what you'd expect on PIE ELFs

$ rop /bin/ls | head -10
Gadgets information
============================================================
0x0000000000010b9a : adc al, 0 ; add byte ptr [rax + 0x39], cl ; ret
0x0000000000014d12 : adc al, 0x25 ; sub byte ptr [rax], al ; add byte ptr [rax], al ; jne 0x14d1c ; leave ; ret
0x0000000000007e20 : adc al, 0x25 ; sub byte ptr [rax], al ; add byte ptr [rax], al ; jne 0x7e3f ; leave ; ret
0x000000000001459e : adc al, 0x28 ; jmp 0x1338b
0x000000000000fdf0 : adc al, 0x38 ; add dword ptr [rax], eax ; jg 0xfdb0 ; jmp 0xff0c
0x0000000000016092 : adc al, 0x50 ; sar edx, 5 ; add edx, 1 ; jmp 0x15dce
0x0000000000006c8e : adc al, 0x91 ; add rdx, rcx ; notrack jmp rdx
0x000000000000cc5f : adc al, 0xa ; cmp esi, eax ; jb 0xcc53 ; jmp 0xcaec

$ rop /bin/ls --offset 0x500000 | head -10
Gadgets information
============================================================
0x0000000000510b9a : adc al, 0 ; add byte ptr [rax + 0x39], cl ; ret
0x0000000000514d12 : adc al, 0x25 ; sub byte ptr [rax], al ; add byte ptr [rax], al ; jne 0x14d1c ; leave ; ret
0x0000000000507e20 : adc al, 0x25 ; sub byte ptr [rax], al ; add byte ptr [rax], al ; jne 0x7e3f ; leave ; ret
0x000000000051459e : adc al, 0x28 ; jmp 0x1338b
0x000000000050fdf0 : adc al, 0x38 ; add dword ptr [rax], eax ; jg 0xfdb0 ; jmp 0xff0c
0x0000000000516092 : adc al, 0x50 ; sar edx, 5 ; add edx, 1 ; jmp 0x15dce
0x0000000000506c8e : adc al, 0x91 ; add rdx, rcx ; notrack jmp rdx
0x000000000050cc5f : adc al, 0xa ; cmp esi, eax ; jb 0xcc53 ; jmp 0xcaec

[captainGeech42]

as a workaround, you can trick it into using a negative number with this syntax:

$ rop ntoskrnl.exe --offset=-0x140000000 | head -10
Gadgets information
============================================================
0x0000000000453627 : adc ah, 0xe3 ; jmp qword ptr [rsi + 0x39]
0x0000000000932d26 : adc ah, 4 ; add byte ptr [rax], al ; mov dword ptr [rbp - 0x30], eax ; jmp 0x140932d34
0x000000000079340a : adc ah, ah ; add al, byte ptr [rax] ; jmp 0x140793417
0x00000000005c5afc : adc ah, ah ; dec dword ptr [rax - 0x75] ; iretd
0x00000000007fb596 : adc ah, ah ; dec dword ptr [rax - 0x7d] ; loope 0x1407fb59b ; jmp 0x14063c7dc
0x0000000000843da2 : adc ah, ah ; dec dword ptr [rbx + 0x2dd3e9c6] ; jmp 0x140843dab
0x000000000040cc79 : adc ah, al ; call qword ptr [rax + 0x20c48348]
0x00000000007ce458 : adc ah, al ; dec dword ptr [rdi] ; mov edx, 0x338910fe ; jmp 0x1405cf61f

this still isn't ideal tough, the PC-relative jmp instructions are being disassembled at the wrong address (I suspect that's a separate bug though)

0x0000000000932d26 : adc ah, 4 ; add byte ptr [rax], al ; mov dword ptr [rbp - 0x30], eax ; jmp 0x140932d34

opcodes:

PAGE:0000000140932D25 8B 80 D4 04 00 00     mov     eax, [rax+4D4h]
PAGE:0000000140932D2B 89 45 D0              mov     [rbp+var_30], eax
PAGE:0000000140932D2E EB 04                 jmp     short loc_140932D34

[SweetVishnya]

Hmm, yeah, I supose --offset option just adds it to each gadget address like gadgetAddr + offset. So, there's actually no option for properly setting image base. If you are willing to make a PR with a new option, I'll be happy to review it)