{"repo":"Ben-Lichtman/ropr","free":true,"listed":false,"github":"https://github.com/Ben-Lichtman/ropr","clone":"git clone https://github.com/Ben-Lichtman/ropr.git","description":"A blazing fast™ multithreaded ROP Gadget finder. ropper / ropgadget alternative (currently x86 only)","language":"Rust","stars":556,"topics":["rop-chain","rop-gadget","rop","exploitation","command-line-tool","rust"],"license":null,"category":"cli-tools","readme_excerpt":"ropr ropr is a blazing fast multithreaded ROP Gadget finder What is a ROP Gadget? ROP (Return Oriented Programming) Gadgets are small snippets of a few assembly instructions typically ending in a ret instruction which already exist as executable code within each binary or library. These gadgets may be used for binary exploitation and to subvert vulnerable executables. When the addresses of many ROP Gadgets are written into a buffer we have formed a ROP Chain. If an attacker can move the stack pointer into this ROP Chain then control can be completely transferred to the attacker. Most executables contain enough gadgets to write a turing-complete ROP Chain. For those that don't, one can always use dynamic libraries contained in the same address-space such as libc once we know their addresses. The beauty of using ROP Gadgets is that no new executable code needs to be written anywhere - an attacker may achieve their objective using only the code that already exists in the program. How do I use a ROP Gadget? Typically the first requirement to use ROP Gadgets is to have a place to write your ROP Chain - this can be any readable buffer. Simply write the addresses of each gadget you would like to use into this buffer. If the buffer is too small there may not be enough room to write a long ROP Chain into and so an attacker should be careful to craft their ROP Chain to be efficient enough to fit into the space available. The next requirement is to be able to control the stack - This ca","default_branch":null,"files":null,"tree":[],"storefront":"/r/Ben-Lichtman","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/Ben-Lichtman/ropr/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}