Ropper v1.13.5 releases: find gadgets to build rop chains for different architectures
You can use ropper to display information about binary files in different file formats and you can search for gadgets to build rop chains for different architectures (x86/X86_64, ARM/ARM64, MIPS/MIPS64, PowerPC). For disassembly, it uses the awesome Capstone Framework.
Install Capstone with PyPi:
$ sudo pip install capstone
Install filebytes with PyPi:
$ sudo pip install filebytes
$ sudo pip install keystone-engine
$ git clone https://github.com/sashs/Ropper.git$ python setup.py install
You can also install with pip
$ pip install ropper
If you don’t want to install filebytes, filebytes is a submodule of the ropper repository. This means you don’t need to install filebytes and ropper.
$ git clone https://github.com/sashs/ropper.git $ cd ropper $ git submodule init $ git submodule update $ ./Ropper.py
THIS FEATURE IS STILL UNDER DEVELOPMENT! Ropper has a semantic search command, which offers the possibility to search for gadgets. Due to a dependency, this command only works with python2 on Linux, but I am working on porting this dependency to python3. Since python3 defaults on some systems, ropper2 can be used to execute ropper with python2.
$ ropper2 --file <afile> --semantic "<any constraint>"
The following optional dependencies are needed to use the semantic search:
$ sudo pip install pyvex
$ python scripts/mk_make.py
$ cd build
$ sudo make install
Currently Possible Constraints
reg == reg – assign register to another
reg == number – assign number to register
reg == [reg] – assign memory to register
reg += number/reg/[reg]
reg -= number/reg/[reg]
reg *= number/reg/[reg]
reg /= number/reg/[reg]
eax==1 !ebx – set eax to 1 and look for gadgets which does not clobber ebx
Copyright 2018 Sascha Schirra