Skip to content

Commit 73119fc

Browse files
Undo improper change to x86 execve syscall code
1 parent 54dc98a commit 73119fc

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

ropper/ropchain/arch/ropchainx86.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -659,7 +659,7 @@ def create(self, options={}):
659659
raise RopChainError('No argument support for execve commands')
660660

661661
self._printMessage('ROPchain Generator for syscall execve:\n')
662-
self._printMessage('\nwrite command into data section\neax 0x3b\nebx address to cmd\necx address to null\nedx address to null\n')
662+
self._printMessage('\nwrite command into data section\neax 0xb\nebx address to cmd\necx address to null\nedx address to null\n')
663663
chain = self._printHeader()
664664
gadgets = []
665665
can_create_command = False
@@ -695,7 +695,7 @@ def create(self, options={}):
695695
gadgets.append((self._createAddress, [cmdaddress],{'reg':'ebx'},['ebx', 'bx', 'bl', 'bh']))
696696
gadgets.append((self._createAddress, [nulladdress],{'reg':'ecx'},['ecx', 'cx', 'cl', 'ch']))
697697
gadgets.append((self._createAddress, [nulladdress],{'reg':'edx'},['edx', 'dx', 'dl', 'dh']))
698-
gadgets.append((self._createNumber, [0x3b],{'reg':'eax'},['eax', 'ax', 'al', 'ah']))
698+
gadgets.append((self._createNumber, [0xb],{'reg':'eax'},['eax', 'ax', 'al', 'ah']))
699699
if address is not None and not can_create_command:
700700
if type(address) is str:
701701
cmdaddress = int(address, 16)
@@ -709,7 +709,7 @@ def create(self, options={}):
709709
gadgets.append((self._createNumber, [cmdaddress],{'reg':'ebx'},['ebx', 'bx', 'bl', 'bh']))
710710
gadgets.append((self._createNumber, [nulladdress],{'reg':'ecx'},['ecx', 'cx', 'cl', 'ch']))
711711
gadgets.append((self._createNumber, [nulladdress],{'reg':'edx'},['edx', 'dx', 'dl', 'dh']))
712-
gadgets.append((self._createNumber, [0x3b],{'reg':'eax'},['eax', 'ax', 'al', 'ah']))
712+
gadgets.append((self._createNumber, [0xb],{'reg':'eax'},['eax', 'ax', 'al', 'ah']))
713713

714714
self._printMessage('Try to create chain which fills registers without delete content of previous filled registers')
715715
chain_tmp += self._createDependenceChain(gadgets)

0 commit comments

Comments
 (0)