- Sep 09, 2016
-
-
Chris Salls authored
Rework roparg filler Changes how the roparg filler is used slightly to allow filling with symbolic values. See merge request !19
-
- Sep 08, 2016
-
-
Chris Salls authored
small rework of the roparg_filler to allow filling with a symbolic value. This is particularly useful for automatic exploitation where the constraint solve should be used to pick the values of the chain fillers
-
- Aug 31, 2016
-
-
Chris Salls authored
-
Chris Salls authored
-
- Aug 29, 2016
-
-
Dobin Rutishauser authored
created common.py to collect functions which are needed in multiple places.
-
Dobin Rutishauser authored
-
Dobin Rutishauser authored
It was not used in rop.py
-
Dobin Rutishauser authored
If we dont want zeros in the ropchain: rop.set_roparg_filler(0xdeadbeef) chain += p32(0x8075932) # mov eax, ebx; pop ebx; mov edx, esi; pop esi; pop ebp; ret chain += p32(0x68732f6e) chain += p32(0x112232fc) chain += p32(0xdeadbeef)
-
- Aug 28, 2016
-
-
Dobin Rutishauser authored
If the string given to write_to_memory is not a multiple of 4 (or 8?), it will need to be padded by a fill byte. The fill byte was set to 0xff. This commit makes it possible to give the fill byte as an argument. E.g. useful if we want to write bash strings, and fill it with spaces or hashtags.
-
- Aug 27, 2016
-
-
Dobin Rutishauser authored
If the user does not want that the shellcode contains certain bytes (e.g. newlines, 0x0 etc), he can now define it in the rop object with the set_badbytes function. rop.load_gadgets("gadgets") rop.set_badbytes([0x01, 0xf9, 0x93, 0x95, 0x96, 0x40]) chain = rop.write_to_mem(0x11223344, "abcdefgh") functions which filter badbytes: write_to_mem add_to_mem write_to_mem_v2 func_call _get_single_ret _find_reg_setting_gadgets _filter_reg_setting_gadgets _get_sufficient_partial_controllers
-
- Aug 09, 2016
-
-
Chris Salls authored
-
-
- Aug 07, 2016
-
-
David Manouchehri authored
-
- Jul 13, 2016
-
-
Chris Salls authored
-
Chris Salls authored
-
- Jul 03, 2016
-
-
Yan Shoshitaishvili authored
update for moved cgc stack See merge request !18
-
- Jun 30, 2016
-
-
Chris Salls authored
-
- Jun 29, 2016
-
-
Chris Salls authored
Wip/boolector See merge request !16
-
Nick Stephens authored
-
Chris Salls authored
shrink stack to 80 dwords See merge request !17
-
Chris Salls authored
-
- Jun 28, 2016
-
-
Nick Stephens authored
-
- Jun 26, 2016
-
-
Chris Salls authored
-
- Jun 23, 2016
-
-
Chris Salls authored
-
Chris Salls authored
-
- Jun 22, 2016
-
-
Chris Salls authored
-
- Jun 19, 2016
-
-
Chris Salls authored
check syscall See merge request !15
-
Chris Salls authored
-
- Jun 15, 2016
-
-
Chris Salls authored
-
- Jun 04, 2016
-
-
Fish Wang authored
Fix/cfgfast fix See merge request !14
-
Chris Salls authored
-
Fish authored
-
Nick Stephens authored
-
- Jun 02, 2016
-
-
Fish authored
-
- May 12, 2016
-
-
Yan Shoshitaishvili authored
Enable tests for patcherex See merge request !13
-
Francesco Disperati authored
-
- May 04, 2016
-
-
Chris Salls authored
-
- Mar 09, 2016
-
-
Chris Salls authored
-
- Mar 05, 2016
-
-
Chris Salls authored
-
Chris Salls authored
-