This commit is contained in:
david942j 2017-03-27 17:05:27 +08:00
parent 9e25366c33
commit 2ed1e32f3f
8 changed files with 28 additions and 8 deletions

2
.gitignore vendored
View File

@ -1,3 +1,5 @@
*.gem *.gem
/coverage/ /coverage/
/libcs/ /libcs/
/doc/
/.yardoc/

View File

@ -3,7 +3,9 @@ module OneGadget
module ABI module ABI
# Define class methods here. # Define class methods here.
module ClassMethods module ClassMethods
# Registers in i386.
LINUX_X86_32 = %w(eax ebx ecx edx edi esi ebp esp).freeze LINUX_X86_32 = %w(eax ebx ecx edx edi esi ebp esp).freeze
# Registers in x86_64/
LINUX_X86_64 = LINUX_X86_32 + %w(rax rbx rcx rdx rdi rsi rbp rsp) + 7.upto(15).map { |i| "r#{i}" } LINUX_X86_64 = LINUX_X86_32 + %w(rax rbx rcx rdx rdi rsi rbp rsp) + 7.upto(15).map { |i| "r#{i}" }
# Registers' name in amd64. # Registers' name in amd64.
# @return [Array<String>] List of registers. # @return [Array<String>] List of registers.

View File

@ -6,6 +6,7 @@ module OneGadget
# Emulator of amd64 instruction set. # Emulator of amd64 instruction set.
class I386 < X86 class I386 < X86
class << self class << self
# Yap, bits.
def bits def bits
32 32
end end

View File

@ -3,10 +3,10 @@ require 'one_gadget/helper'
module OneGadget module OneGadget
module Emulators module Emulators
# A {Lambda} object can be: # A {Lambda} object can be:
# 1. {String} # variable name # 1. +String+ (variable name)
# 2. {Numeric} # 2. +Numeric+
# 3. {Lambda} + {Numeric} # 3. {Lambda} + +Numeric+
# 4. dereference {Lambda} # 4. dereferenced {Lambda}
class Lambda class Lambda
attr_accessor :obj # @return [String, Lambda] The object currently related to. attr_accessor :obj # @return [String, Lambda] The object currently related to.
attr_accessor :immi # @return [Integer] The immidiate value currently added. attr_accessor :immi # @return [Integer] The immidiate value currently added.
@ -49,6 +49,7 @@ module OneGadget
# Decrease dreference count with 1. # Decrease dreference count with 1.
# @return [void] # @return [void]
# @raise [ArgumentError] When this object cannot be referenced anymore.
def ref! def ref!
raise ArgumentError, 'Cannot reference anymore!' if @deref_count <= 0 raise ArgumentError, 'Cannot reference anymore!' if @deref_count <= 0
@deref_count -= 1 @deref_count -= 1
@ -86,14 +87,18 @@ module OneGadget
end end
class << self class << self
# Target: parse something like +[rsp+0x50]+ into a {Lambda} object. # Target: parse things like <tt>[rsp+0x50]</tt> into a {Lambda} object.
# @param [String] arg # @param [String] arg
# @param [Hash{String => Lambda}] predefined # @param [Hash{String => Lambda}] predefined
# Predfined values.
# @return [OneGadget::Emulators::Lambda, Integer] # @return [OneGadget::Emulators::Lambda, Integer]
# If +arg+ contains number only, return it. # If +arg+ contains number only, return it.
# Otherwise, return a {Lambda} object. # Otherwise, return a {Lambda} object.
# @example # @example
# parse('[rsp+0x50]') #=> #<Lambda @obj='rsp', @immi=80, @deref_count=1> # obj = parse('[rsp+0x50]')
# #=> #<Lambda @obj='rsp', @immi=80, @deref_count=1>
# parse('obj+0x30', predefined: { 'obj' => obj }).to_s
# #=> '[rsp+0x50]+0x30'
def parse(arg, predefined: {}) def parse(arg, predefined: {})
deref_count = 0 deref_count = 0
if arg[0] == '[' # a little hack because there should nerver something like +[[rsp+1]+2]+ to parse. if arg[0] == '[' # a little hack because there should nerver something like +[[rsp+1]+2]+ to parse.

View File

@ -2,7 +2,7 @@ require 'shellwords'
module OneGadget module OneGadget
module Fetcher module Fetcher
# define common methods for gadget fetchers. # Define common methods for gadget fetchers.
class Base class Base
# The absolute path of glibc. # The absolute path of glibc.
# @return [String] The filename. # @return [String] The filename.
@ -19,6 +19,12 @@ module OneGadget
end end
# Fetch candidates that end with call exec*. # Fetch candidates that end with call exec*.
#
# Give a block to filter gadget candidates.
# @yieldparam [String] cand
# Is this candidate valid?
# @yieldreturn [Boolean]
# True for valid.
# @return [Array<String>] # @return [Array<String>]
# Each +String+ returned is multi-lines of assembly code. # Each +String+ returned is multi-lines of assembly code.
def candidates(&block) def candidates(&block)

View File

@ -40,7 +40,9 @@ module OneGadget
# Define class methods here. # Define class methods here.
module ClassMethods module ClassMethods
# Path to the pre-build files.
BUILDS_PATH = File.join(__dir__, 'builds').freeze BUILDS_PATH = File.join(__dir__, 'builds').freeze
# Cache.
BUILDS = Hash.new { |h, k| h[k] = [] } BUILDS = Hash.new { |h, k| h[k] = [] }
# Get gadgets from pre-defined corpus. # Get gadgets from pre-defined corpus.
# @param [String] build_id Desired build id. # @param [String] build_id Desired build id.

View File

@ -9,6 +9,7 @@ require 'one_gadget/logger'
module OneGadget module OneGadget
# Define some helpful methods here. # Define some helpful methods here.
module Helper module Helper
# Format of build-id, 40 hex numbers.
BUILD_ID_FORMAT = /[0-9a-f]{40}/ BUILD_ID_FORMAT = /[0-9a-f]{40}/
# Define class methods here. # Define class methods here.
module ClassMethods module ClassMethods
@ -125,7 +126,7 @@ module OneGadget
end end
# Fetch the file archiecture of +file+. # Fetch the file archiecture of +file+.
# @param [String] The target ELF filename. # @param [String] file The target ELF filename.
# @return [String] # @return [String]
# Only supports :amd64, :i386 now. # Only supports :amd64, :i386 now.
def architecture(file) def architecture(file)

View File

@ -1,3 +1,4 @@
module OneGadget module OneGadget
# Current gem version.
VERSION = '1.3.4.1'.freeze VERSION = '1.3.4.1'.freeze
end end