Skip to content
/ kropr Public
forked from Ben-Lichtman/ropr

ropr with some tweaks for better linux kernel support

Notifications You must be signed in to change notification settings

zolutal/kropr

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

96 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Install

Use install.sh to install as 'kropr' without breaking unmodified ropr installation

Changes Made:

Prevent scanning executable sections besides .text (e.g. .init.text for gadgets), they won't be executable at runtime. Cuts down on false positives.

Change 'sys' gadgets to not include syscall or int 0x80 since those are never useful in the kernel, the remaining 'sys' gadgets -- sysret/iret/sysexit -- can be filtered out with '--nosys' as before.

Do not include results with interrupt instructions (e.g. int3).

Find gadgets that end in jmp __x86_return_thunk, jmp __x86_indirect_thunk_r*, jmp __x86_indirect_jump_thunk_r*, jmp __x86_indirect_call_thunk_r*

Made it so that --noisy treats anything ending in a branch/call as a potential gadget, excluding near jumps can mean that when symbols are not available thunked gadgets are not found

Output can be sorted alphabetically via the --sort option

The --magic flag can be used to get some commonly used offsets

About

ropr with some tweaks for better linux kernel support

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Rust 99.7%
  • Shell 0.3%