longld/peda — pull request #3 by JonathanSalwan (2012-12-05 11:13:03+00:00)
Title: Add new feature - roptable()

Hi,

New feature. roptable(). You can search gadgets defined in roptable (roptable.rop).

Ex:

In my roptable :

ARCH::x86-64::{
'pop _ALLREG64_ ; ret'
'pop _ALLREG64_ ; pop _ALLREG64_ ; ret'
'xor _ALLREG64_, _ALLREG64_ ; ret'
'jmp _ALLREG64_'
'call _ALLREG64_'
'add rsp, 0x8 ; ret'
'syscall'
'sysenter'
}

Now in peda.

$ gdb /usr/bin/id
[...]
gdb-peda$ roptable x86-64
0x40194e:	add rsp, 0x8 ; ret
0x403cc6:	pop rax ; ret
0x40282c:	pop rbx ; ret
0x402730:	pop rdi ; ret
0x403c2c:	pop rbp ; ret
0x403c2b:	pop r13 ; ret
0x40272f:	pop r15 ; ret
0x4019ee:	jmp rax
0x40194c:	call rax
0x40272e:	pop rsi ; pop r15 ; ret
0x403c2a:	pop rsp ; pop r13 ; ret
0x403c29:	pop r12 ; pop r13 ; ret
0x40272d:	pop r14 ; pop r15 ; ret
gdb-peda$

It's possible to change roptable structure for search specific gadgets.

Jonathan,