@@ -659,7 +659,7 @@ def create(self, options={}):
659
659
raise RopChainError ('No argument support for execve commands' )
660
660
661
661
self ._printMessage ('ROPchain Generator for syscall execve:\n ' )
662
- self ._printMessage ('\n write command into data section\n eax 0x3b \n ebx address to cmd\n ecx address to null\n edx address to null\n ' )
662
+ self ._printMessage ('\n write command into data section\n eax 0xb \n ebx address to cmd\n ecx address to null\n edx address to null\n ' )
663
663
chain = self ._printHeader ()
664
664
gadgets = []
665
665
can_create_command = False
@@ -695,7 +695,7 @@ def create(self, options={}):
695
695
gadgets .append ((self ._createAddress , [cmdaddress ],{'reg' :'ebx' },['ebx' , 'bx' , 'bl' , 'bh' ]))
696
696
gadgets .append ((self ._createAddress , [nulladdress ],{'reg' :'ecx' },['ecx' , 'cx' , 'cl' , 'ch' ]))
697
697
gadgets .append ((self ._createAddress , [nulladdress ],{'reg' :'edx' },['edx' , 'dx' , 'dl' , 'dh' ]))
698
- gadgets .append ((self ._createNumber , [0x3b ],{'reg' :'eax' },['eax' , 'ax' , 'al' , 'ah' ]))
698
+ gadgets .append ((self ._createNumber , [0xb ],{'reg' :'eax' },['eax' , 'ax' , 'al' , 'ah' ]))
699
699
if address is not None and not can_create_command :
700
700
if type (address ) is str :
701
701
cmdaddress = int (address , 16 )
@@ -709,7 +709,7 @@ def create(self, options={}):
709
709
gadgets .append ((self ._createNumber , [cmdaddress ],{'reg' :'ebx' },['ebx' , 'bx' , 'bl' , 'bh' ]))
710
710
gadgets .append ((self ._createNumber , [nulladdress ],{'reg' :'ecx' },['ecx' , 'cx' , 'cl' , 'ch' ]))
711
711
gadgets .append ((self ._createNumber , [nulladdress ],{'reg' :'edx' },['edx' , 'dx' , 'dl' , 'dh' ]))
712
- gadgets .append ((self ._createNumber , [0x3b ],{'reg' :'eax' },['eax' , 'ax' , 'al' , 'ah' ]))
712
+ gadgets .append ((self ._createNumber , [0xb ],{'reg' :'eax' },['eax' , 'ax' , 'al' , 'ah' ]))
713
713
714
714
self ._printMessage ('Try to create chain which fills registers without delete content of previous filled registers' )
715
715
chain_tmp += self ._createDependenceChain (gadgets )
0 commit comments