Gallopsled/pwntools — pull request #68 by zachriggle (2014-08-05 02:26:49+00:00)
Title: Implement absolute ROP loading given a static base address

Implement absolute ROP addressing, and recursive string/struct loading based off of absolute addresses.

### Script

```python
from pwn import *

bash = ELF('/vortex/vortex13')
libs = gdb.find_module_addresses(bash.path)
rop = ROP(libs+[bash])

rop.migrate(0x1000000)
print '\n'.join(rop.dump())
print '\n'*3

rop.flush()
sz = "Hello, Gallopsled\n"

rop.set_address(0x1000000)
rop.mmap("/tmp/baz","w+")
rop.write(1, sz, len(sz))

print '\n'.join(rop.dump())
print '\n'*3
print hexdump(str(rop), begin=rop.address)
```

### Output

```
[+] Started program 'gdb'
[*] Loading gadgets for '/lib/i386-linux-gnu/libc.so.6' @ 0xf7557000
[+] Binary loaded
[+] Loading gadgets, please wait...
[+] Gadgets loaded !
[*] Loading gadgets for '/lib/ld-linux.so.2' @ 0xf7727000
[+] Binary loaded
[+] Loading gadgets, please wait...
[+] Gadgets loaded !
[*] Found gadgets for '/vortex/vortex13' in cache '/tmp/user/pwntools-rop-cache/vortex13-585d3aab6cc29a38037fd8f866452fb5-0x8048000'
0000: f87872f7 0xf77278f8 pop ebp; ret
0004: 00000001 0x1000000
0008: 5ab65ff7 0xf75fb65a leave; ret

1000000: c0ea63f7 0xf763eac0 mmap
1000004: 557e72f7 0xf7727e55 pop esi; pop edi; ret
1000008: 24000001 0x1000024 <========= +24
100000c: 2c000001 0x100002c <========= +2C
1000010: 702763f7 0xf7632770 write
1000014: efbeadde 0xdeadbeef
1000018: 01000000 0x1
100001c: 30000001 0x1000030 <========= +30
1000020: 12000000 0x12
1000024: 2f746d70 0x706d742f
1000028: 2f62617a 0x7a61622f
100002c: 772b0000 0x2b77
1000030: 48656c6c 0x6c6c6548
1000034: 6f2c2047 0x47202c6f
1000038: 616c6c6f 0x6f6c6c61
100003c: 70736c65 0x656c7370
1000040: 640a0000 0xa64

01000000 c0 ea 63 f7 55 7e 72 f7 24 00 00 01 2c 00 00 01 |..c.U~r.$...,...|
01000010 70 27 63 f7 ef be ad de 01 00 00 00 30 00 00 01 |p'c.........0...|
01000020 12 00 00 00 2f 74 6d 70 2f 62 61 7a 77 2b 00 00 |..../tmp/bazw+..|
01000030 48 65 6c 6c 6f 2c 20 47 61 6c 6c 6f 70 73 6c 65 |Hello,.Gallopsle|
01000040 64 0a 00 00 |d...|
00000044
```