Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ropchain constraint syntax parser #4552

Merged
merged 30 commits into from
Jul 10, 2024
Merged

Ropchain constraint syntax parser #4552

merged 30 commits into from
Jul 10, 2024

Conversation

giridharprasath
Copy link
Contributor

@giridharprasath giridharprasath commented Jun 13, 2024

  • Parse the rop constraints
  • Update esil output to rzil sdb
  • Add /Rg gadget command

Current ROP chain parser misses some gadget when compared with the ROPGadget
Asm:

section .text
global _start
_start:
mov dword [esp+0x0],0x80484b0
ret

ROPgadget output:
ScreenShot_2024-06-13_at_06:15:20-PM

Rizin output before
ScreenShot_2024-06-13_at_06:14:47-PM

Rizin output now:
ScreenShot_2024-06-13_at_06:15:54-PM

These ROP gadgets are needed for crafting better rop chains.

Partially fix: #2080

Your checklist for this pull request

  • I've read the guidelines for contributing to this repository
  • I made sure to follow the project's coding style
  • I've documented or updated the documentation of every function and struct this PR changes. If not so I've explained why.
  • I've added tests that prove my fix is effective or that my feature works (if possible)
  • I've updated the rizin book with the relevant information (if needed)

Detailed description

...

Test plan

...

Closing issues

...

@XVilka XVilka added this to the 0.8.0 milestone Jun 13, 2024
@XVilka XVilka added ROP ROP search and generation test-required labels Jun 13, 2024
librz/core/cmd/cmd_search_rop.c Outdated Show resolved Hide resolved
librz/core/cmd/cmd_search_rop.c Outdated Show resolved Hide resolved
librz/core/cmd/cmd_search_rop.c Outdated Show resolved Hide resolved
librz/core/cmd/cmd_search_rop.c Outdated Show resolved Hide resolved
librz/core/rop.c Outdated Show resolved Hide resolved
librz/core/rop.c Outdated Show resolved Hide resolved
librz/core/rop.c Outdated Show resolved Hide resolved
librz/il/meson.build Outdated Show resolved Hide resolved
librz/include/rz_rop.h Outdated Show resolved Hide resolved
librz/include/rz_rop.h Outdated Show resolved Hide resolved
@giridharprasath
Copy link
Contributor Author

giridharprasath commented Jun 24, 2024

  0x00400565               0000  add byte [rax], al
  0x00400567           007cffff  add byte [rdi + rdi*8 - 1], bh
  0x0040056b           ff6c0000  jmp [rax + rax]
Gadget size: 10

Current /Rg output:
Gadget 0x400565
Stack change: 0x8
Changed registers: rax rdi rbx 
Register dependencies:
rax rax rax rdi rdi rdi rdi rbx rax rax 

TODO:
Update the changed registers based on the init_val and new_val
The dependencies list(still in progress, has to be verbose) is memory read and write done on the registers in the gadget.
Stack change should be updated.
Show jump or syscall
Fix leaks

@giridharprasath
Copy link
Contributor Author

giridharprasath commented Jun 25, 2024

Current output:

  0x004003d0                 a6  cmpsb byte [rsi], byte ptr [rdi]
  0x004003d1               0440  add al, 0x40
  0x004003d3               00ff  add bh, bh
  0x004003d5         15160c2000  adc eax, 0x200c16
  0x004003da                 f4  hlt
Gadget size: 11
Gadget 0x4003d0
Stack change: 0x0
Changed registers: rsi rdi rax rbx 
Register dependencies:
Memory Read: rsi 5
Memory Read: rdi 4195495
Var write: rax 4195648 4195712
Var write: rbx 0 0
Var write: rbx 0 0
Var write: rax 4195648 6295958

Added support for stack change
Add the memory read and write to dependencies list
Track the register state in modified_registers

Another eg:

  0x0040052d                 5c  pop rsp
  0x0040052e               415d  pop r13
  0x00400530               415e  pop r14
  0x00400532               415f  pop r15
  0x00400534                 c3  ret
Gadget size: 8
Gadget 0x40052d
Stack change: 0x28
Changed registers: rsp r13 r14 r15 
Register dependencies:

@giridharprasath
Copy link
Contributor Author

Current output:

ScreenShot_2024-06-27_at_12:26:01-AM

TODO:

Refactor construct_rop_gadget API and move the il event handling code to Rg handler
Tidy up the Rg cmd output
Fix Unit and regression TC

librz/arch/analysis.c Outdated Show resolved Hide resolved
librz/include/rz_rop.h Outdated Show resolved Hide resolved
librz/include/rz_rop.h Outdated Show resolved Hide resolved
librz/core/cmd/cmd_search_rop.c Show resolved Hide resolved
test/db/cmd/cmd_rop Outdated Show resolved Hide resolved
@giridharprasath giridharprasath marked this pull request as ready for review June 28, 2024 11:05
@XVilka

This comment was marked as resolved.

test/prj/v15-seek-history.rzdb Outdated Show resolved Hide resolved
Copy link
Member

@XVilka XVilka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks better! Only few small nitpicks left, apart from that - LGTM.

librz/core/rop.c Outdated Show resolved Hide resolved
librz/core/rop.c Outdated Show resolved Hide resolved
librz/core/rop.c Outdated Show resolved Hide resolved
librz/core/rop.c Outdated Show resolved Hide resolved
librz/core/rop.c Outdated Show resolved Hide resolved
Copy link
Member

@XVilka XVilka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Next time please use different branch name, by the way.

librz/arch/analysis.c Outdated Show resolved Hide resolved
librz/include/rz_rop.h Outdated Show resolved Hide resolved
Copy link
Member

@wargio wargio left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Huge improvements. fix the comments i left and i think we can merge.

@XVilka XVilka requested a review from wargio July 9, 2024 23:55
librz/include/rz_rop.h Outdated Show resolved Hide resolved
librz/arch/analysis.c Outdated Show resolved Hide resolved
librz/include/rz_analysis.h Outdated Show resolved Hide resolved
@wargio wargio requested a review from Rot127 July 10, 2024 03:23
@wargio wargio merged commit c8d0505 into rizinorg:dev Jul 10, 2024
44 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

ESIL to RZIL conversion
5 participants