ROPgadget Command Examples (with examples)
List gadgets in the binary file
ROPgadget --binary path/to/binary
Motivation: This command is used to list all the ROP (Return-Oriented Programming) gadgets present in a binary file. ROP gadgets are small sequences of instructions that end in a “return” instruction, which can be chained together to create arbitrary code execution.
Explanation: The --binary argument specifies the path to the binary file in which the gadgets should be searched. By running this command, ROPgadget will analyze the binary file and output a list of all the available gadgets.
Example Output:
Gadgets Information
============================================================
Gadgets found: 348
** Architecture: amd64
gadget 0x00007ff793ccad5f: xor rax, rax ; mov qword ptr [rsp], rax ; ret ; (1 found)
gadget 0x00007ff793ccad69: xor esi, esi ; xor edi, edi ; mov eax, 0 ; xor eax, eax ; ret ; (1 found)
gadget 0x00007ff793ccad70: xor esi, esi ; xor edi, edi ; ret ; (1 found)
...
Filter gadgets in the binary file by a regular expression
ROPgadget --binary path/to/binary --re regex
Motivation: Sometimes, you may want to filter the gadgets based on a specific pattern or regular expression. This can be useful when you are looking for specific instructions or gadgets with certain properties.
Explanation: The --re argument allows you to provide a regular expression that is used to filter the gadgets. Only the gadgets matching the regular expression will be displayed in the output.
Example Output:
Gadgets Information
============================================================
Gadgets found: 73
** Architecture: amd64
gadget 0x00007ff793ccad5f: xor rax, rax ; mov qword ptr [rsp], rax ; ret ; (1 found)
gadget 0x00007ff793ccad69: xor esi, esi ; xor edi, edi ; mov eax, 1 ; xor eax, eax ; ret ; (1 found)
...
List gadgets in the binary file, excluding specified type
ROPgadget --binary path/to/binary --norop|nojop|nosys
Motivation: There might be cases where you want to exclude certain type of gadgets from the output. This can be relevant if you are looking for specific gadgets like “system” gadgets or “return-oriented programming” gadgets.
Explanation: The --norop, --nojop, and --nosys flags are used to exclude ROP gadgets, JOP (Jump-Oriented Programming) gadgets, and system gadgets respectively. By including any of these flags in the command, the corresponding type of gadgets will not be displayed in the output.
Example Output:
Gadgets Information
============================================================
Gadgets found: 50
** Architecture: amd64
gadget 0x00007ff793ccad70: xor esi, esi ; xor edi, edi ; ret ; (1 found)
gadget 0x00007ff793ccad7b: mov rcx, rax ; add rsp, 0x28 ; pop rbx ; pop rbp ; ret ; (1 found)
...
Exclude bad byte gadgets in the binary file
ROPgadget --binary path/to/binary --badbytes byte_string
Motivation: Sometimes, certain bytes in a gadget can cause issues or restrictions when constructing a ROP chain, such as null bytes. Excluding gadgets with such “bad” bytes can help in avoiding these restrictions.
Explanation: The --badbytes argument allows you to specify a byte string that should not appear in the gadgets. If any gadget contains the specified byte string, it will be excluded from the output.
Example Output:
Gadgets Information
============================================================
Gadgets found: 275
** Architecture: amd64
gadget 0x00007ff793ccad5f: xor rax, rax ; mov qword ptr [rsp], rax ; ret ; (1 found)
gadget 0x00007ff793ccad63: xor esi, esi ; mov edi, 0x1 ; xor eax, eax ; ret ; (1 found)
...
List gadgets up to the specified number of bytes in the binary file
ROPgadget --binary path/to/binary --depth nbyte
Motivation: In certain scenarios, you might want to limit the length of the gadgets in the output, for example, to focus on shorter gadgets that can fit within a specific constraint or memory region.
Explanation: The --depth argument allows you to specify the maximum length, in bytes, of the gadgets that should be displayed in the output. Only the gadgets up to the specified depth will be listed.
Example Output:
Gadgets Information
============================================================
Gadgets found: 671
** Architecture: amd64
gadget 0x00007ff793ccad5f: xor rax, rax ; mov qword ptr [rsp], rax ; ret ; (1 found)
gadget 0x00007ff793ccad63: xor esi, esi ; mov edi, 0x1 ; xor eax, eax ; ret ; (1 found)
...
By using these different use cases of the ROPgadget command, it becomes easier to analyze binary files and identify potential ROP gadgets that can be used in exploit development or vulnerability research.
