yarjor

Some notes I wrote to myself concerning making of ROP-chains:

Creating a shellcode / pseudo-shellcode before starting to build the ROP-chain is useful and will be a reference of what you need, especially when trying to do something special in the ROP (eg. not execve ;) )

Quick profit with ROP

This is a quick trick to build a ropchain :)

First, you need to find certain gadgets for needed operations:

a. pop gadget for each of the registers ebx, ecx, edx (for setting them up as arguments for syscall)

b. xor and inc gadgets for eax (for setting up the syscall number)

To enter repeating characters in bash (e.g 42 * 'A'), press alt+<n> where n is the repetition count, then type the repeating character. alt+100 A

The most useful feature in r2 for working with data structures is pf commands, which prints formatted data. You can use this command to print data in certain address according to a defined format, and moreover - define specific formats, for repeating structure. The command is used as pf [types] [member1] [member2] [...]. To see all the type code, pf??, and pf??? for some usage examples. To define a type, use pf.[type] [..]. Example:

[0x08048e26]> pf.node ii*? value index (node)next
[0x08048e26]> pf.node @@ obj.node*
 value : 0x0804b230 = 432
 index : 0x0804b234 = 6
 next : (*0x0) NULL

	get_eip_control() {
	(ragg2 -P 1024 -r \| $*) && echo "No eip control found" && return 1
	(coredumpctl dump > eip_control.core) 2>/dev/null
	local eip=$(r2 -qc "dr eip" eip_control.core \| tail -n 1)
	echo "Offset to control EIP: $(r2 -qc "wopO $eip" --)"
	rm eip_control.core
	}

	def detect_cipher(cipher_box):
	chosen_plaintext = 'a' * 16 * 6
	cipher_text = cipher_box(chosen_plaintext)
	cipher_blocks = divide_blocks(cipher_text, 16)
	if len(cipher_blocks) != len(set(cipher_blocks)):
	return 'ECB'
	else:
	return 'CBC'

	def detect_block_size(cipher_box):
	last_size = len(cipher_box('A'))
	counter = 0
	while True:
	counter += 1
	new_size = len(cipher_box('A' * counter))
	if new_size > last_size:
	return new_size - last_size
	last_size = new_size

	BITS 32
	/* Zero out registers */
	xor ecx, ecx
	mul ecx
	/* NULL byte */
	push ecx
	/* push filename */
	push 0x73
	push 0x7361702e
	push 0x2f413363

	# WARNING: This is probably bad in most cases, you should first analyze your binary and figure out if you really want to nop out all xrefs...

	import r2pipe
	import sys

	NOP = '90'

	def main(binary, location):
	r2 = r2pipe.open(binary, ['-w'])
	print '[-] Analyzing binary...'