@@ -652,7 +652,7 @@ def create(self, options):
652
652
raise RopChainError ('No argument support for execve commands' )
653
653
654
654
self ._printMessage ('ROPchain Generator for syscall execve:\n ' )
655
- self ._printMessage ('\n write command into data section\n rax 0xb \n rdi address to cmd\n rsi address to null\n rdx address to null\n ' )
655
+ self ._printMessage ('\n write command into data section\n rax 0x3b \n rdi address to cmd\n rsi address to null\n rdx address to null\n ' )
656
656
chain = self ._printHeader ()
657
657
gadgets = []
658
658
can_create_command = False
@@ -689,7 +689,7 @@ def create(self, options):
689
689
gadgets .append ((self ._createAddress , [cmdaddress ],{'reg' :'rdi' },['rdi' ,'edi' , 'di' ]))
690
690
gadgets .append ((self ._createAddress , [nulladdress ],{'reg' :'rsi' },['rsi' ,'esi' , 'si' ]))
691
691
gadgets .append ((self ._createAddress , [nulladdress ],{'reg' :'rdx' },['rdx' ,'edx' , 'dx' , 'dl' , 'dh' ]))
692
- gadgets .append ((self ._createNumber , [59 ],{'reg' :'rax' },['rax' ,'eax' , 'ax' , 'al' , 'ah' ]))
692
+ gadgets .append ((self ._createNumber , [0x3b ],{'reg' :'rax' },['rax' ,'eax' , 'ax' , 'al' , 'ah' ]))
693
693
if address is not None and not can_create_command :
694
694
if type (address ) is str :
695
695
cmdaddress = int (address , 16 )
@@ -704,7 +704,7 @@ def create(self, options):
704
704
gadgets .append ((self ._createNumber , [cmdaddress ],{'reg' :'rdi' },['rdi' ,'edi' , 'di' ]))
705
705
gadgets .append ((self ._createNumber , [nulladdress ],{'reg' :'rsi' },['rsi' ,'esi' , 'si' ]))
706
706
gadgets .append ((self ._createNumber , [nulladdress ],{'reg' :'rdx' },['rdx' ,'edx' , 'dx' , 'dl' , 'dh' ]))
707
- gadgets .append ((self ._createNumber , [59 ],{'reg' :'rax' },['rax' ,'eax' , 'ax' , 'al' , 'ah' ]))
707
+ gadgets .append ((self ._createNumber , [0x3b ],{'reg' :'rax' },['rax' ,'eax' , 'ax' , 'al' , 'ah' ]))
708
708
709
709
self ._printMessage ('Try to create chain which fills registers without delete content of previous filled registers' )
710
710
chain_tmp += self ._createDependenceChain (gadgets )
0 commit comments