Skip to content

Commit 77b88b4

Browse files
committed
Fix message for execve syscall in x86_64.
Also use hex-formatted index in the ropchain generator to be more consistent with the x86 generator (this is not a functional change).
1 parent 85e0379 commit 77b88b4

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

ropper/ropchain/arch/ropchainx86_64.py

+3-3
Original file line numberDiff line numberDiff line change
@@ -652,7 +652,7 @@ def create(self, options):
652652
raise RopChainError('No argument support for execve commands')
653653

654654
self._printMessage('ROPchain Generator for syscall execve:\n')
655-
self._printMessage('\nwrite command into data section\nrax 0xb\nrdi address to cmd\nrsi address to null\nrdx address to null\n')
655+
self._printMessage('\nwrite command into data section\nrax 0x3b\nrdi address to cmd\nrsi address to null\nrdx address to null\n')
656656
chain = self._printHeader()
657657
gadgets = []
658658
can_create_command = False
@@ -689,7 +689,7 @@ def create(self, options):
689689
gadgets.append((self._createAddress, [cmdaddress],{'reg':'rdi'},['rdi','edi', 'di']))
690690
gadgets.append((self._createAddress, [nulladdress],{'reg':'rsi'},['rsi','esi', 'si']))
691691
gadgets.append((self._createAddress, [nulladdress],{'reg':'rdx'},['rdx','edx', 'dx', 'dl', 'dh']))
692-
gadgets.append((self._createNumber, [59],{'reg':'rax'},['rax','eax', 'ax', 'al', 'ah']))
692+
gadgets.append((self._createNumber, [0x3b],{'reg':'rax'},['rax','eax', 'ax', 'al', 'ah']))
693693
if address is not None and not can_create_command:
694694
if type(address) is str:
695695
cmdaddress = int(address, 16)
@@ -704,7 +704,7 @@ def create(self, options):
704704
gadgets.append((self._createNumber, [cmdaddress],{'reg':'rdi'},['rdi','edi', 'di']))
705705
gadgets.append((self._createNumber, [nulladdress],{'reg':'rsi'},['rsi','esi', 'si']))
706706
gadgets.append((self._createNumber, [nulladdress],{'reg':'rdx'},['rdx','edx', 'dx', 'dl', 'dh']))
707-
gadgets.append((self._createNumber, [59],{'reg':'rax'},['rax','eax', 'ax', 'al', 'ah']))
707+
gadgets.append((self._createNumber, [0x3b],{'reg':'rax'},['rax','eax', 'ax', 'al', 'ah']))
708708

709709
self._printMessage('Try to create chain which fills registers without delete content of previous filled registers')
710710
chain_tmp += self._createDependenceChain(gadgets)

0 commit comments

Comments
 (0)