Skip to content

Add LDM / LDMDB JOP gadgets for ARM Thumb2 #207

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jan 22, 2025
+8 −2
Merged

Add LDM / LDMDB JOP gadgets for ARM Thumb2 #207

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d5eeef5
Add LDM / LDMDB JOP gadgets for ARM Thumb2
face0xff Jan 22, 2025
9edc6b9
tests: add arm thumb test
face0xff Jan 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions ropgadget/gadgets.py
View file
Original file line number Diff line number Diff line change
@@ -288,13 +288,17 @@ def addJOPGadgets(self, section):
gadgets = [
[b"\x47[\x00\x08\x10\x18\x20\x28\x30\x38\x40\x48\x70]{1}", 2, 2], # bx reg
[b"\x47[\x80\x88\x90\x98\xa0\xa8\xb0\xb8\xc0\xc8\xf0]{1}", 2, 2], # blx reg
[b"\xbd[\x00-\xff]{1}", 2, 2] # pop {,pc}
[b"\xbd[\x00-\xff]{1}", 2, 2], # pop {,pc}
[b"\xe8[\x90-\x9f\xb0-\xbf][\x00-\xff]{4}", 4, 2], # ldm.w reg{!}, {,pc}
[b"\xe9[\x10-\x1f\x30-\x3f][\x00-\xff]{4}", 4, 2] # ldmdb reg{!}, {,pc}
]
else:
gadgets = [
[b"[\x00\x08\x10\x18\x20\x28\x30\x38\x40\x48\x70]{1}\x47", 2, 2], # bx reg
[b"[\x80\x88\x90\x98\xa0\xa8\xb0\xb8\xc0\xc8\xf0]{1}\x47", 2, 2], # blx reg
[b"[\x00-\xff]{1}\xbd", 2, 2] # pop {,pc}
[b"[\x00-\xff]{1}\xbd", 2, 2], # pop {,pc}
[b"[\x90-\x9f\xb0-\xbf]\xe8[\x00-\xff]{4}", 4, 2], # ldm.w reg{!}, {,pc}
[b"[\x10-\x1f\x30-\x3f]\xe9[\x00-\xff]{4}", 4, 2] # ldmdb reg{!}, {,pc}
]
arch_mode = CS_MODE_THUMB
else:
Binary file modified test-suite-binaries/ref_output.bz2
View file
Binary file not shown.
2 changes: 2 additions & 0 deletions test-suite-binaries/test.sh
View file
Original file line number Diff line number Diff line change
@@ -57,6 +57,8 @@ echo "RUN Linux_lib64.so --offset 0xdeadbeef00000000" | tee -a ./test_output
$RUN --binary ./Linux_lib64.so --offset 0xdeadbeef00000000 1>> ./test_output
echo "RUN elf-ARMv7-ls --depth 5" | tee -a ./test_output
$RUN --binary ./elf-ARMv7-ls --depth 5 1>> ./test_output
echo "RUN elf-ARMv7-ls --thumb --depth 5" | tee -a ./test_output
$RUN --binary ./elf-ARMv7-ls --thumb --depth 5 1>> ./test_output
echo "RUN elf-ARM64-bash --depth 5" | tee -a ./test_output
$RUN --binary ./elf-ARM64-bash --depth 5 1>> ./test_output
echo "RUN elf-PPC64-bash --depth 5" | tee -a ./test_output