angrop: rop gadget finder and chain builder
angrop is a rop gadget finder and chain builder
angrop is a tool to automatically generate rop chains.
It is built on top of angr’s symbolic execution engine and uses constraint solving for generating chains and understanding the effects of gadgets.
angrop should support all the architectures supported by angr, although more testing needs to be done.
Typically, it can generate rop chains (especially long chains) faster than humans.
It includes functions to generate chains which are commonly used in exploitation and CTF’s, such as setting registers and calling functions.
git clone https://github.com/salls/angrop.git
python setup.py install
The ROP analysis finds rop gadgets and can automatically build rop chains.
Gadgets contain a lot of information:
For example look at how the following code translates into a gadget
The dependencies describe what registers affect the final value of another register. In the example above, the final value of rbp depends on both rdi and rbp. Dependencies are analyzed for registers and for memory actions. All of the information is stored as properties in the gadgets, so it is easy to iterate over them and find gadgets which fit your needs.
Copyright (c) 2015, The Regents of the University of California
All rights reserved.