JonathanSalwan/ROPgadget — pull request #48 by 84a0deba7af552d68c80a16b20cdef32 (2014-07-10 10:44:18+00:00)
Title: Added support for --multibr

I recently spent too much time looking for an initial gadget that could be used to gain control of stack and allow further execution. Manual examination of the binary yielded a gadget that ROPgadget had thrown out due to containing multiple branch instructions, often times a call + ret are perfectly usable.

The following example is derived from the target binary I was ropping against:

```c
int main()
{
__asm__("call *0x10(%rax,%rbx)\n"
"pop %r12\n"
"pop %rbp\n"
"ret");
return 0;
}
```
ROPgadget.py currently does not identify this gadget.
```bash
navs@debian:~/ROPgadget$ ./ROPgadget.py --binary ~/test |grep 0x0000000000400478
navs@debian:~/ROPgadget$
```
I have added a multibr option that can be used to enable the display of gadgets that are currently discarded in
__passCleanX86.
```bash
navs@debian:~/ROPgadget.multibr$ ./ROPgadget.py --multibr --binary ~/test |grep 0x0000000000400478
0x0000000000400478 : call qword ptr [rax + rbx + 0x10] ; pop r12 ; pop rbp ; ret
```

Note: this gadget is still not identified by either the current ROPgadget or my branch as being the end of a gadget. I believe this to be a bug as other indirect calls are identified. I am looking into this and will submit a remedy when I sort it out.