Skip to content

Commit 48d76ed

Browse files
peace-makerArusekk
andauthored
Support adding lists in ROP.raw() (Gallopsled#2128)
* Support adding lists in `ROP.raw()` Allow to add multiple raw entries on a rop chain using an array instead of multiple calls to `raw()`. ```py rop = ROP('/bin/ls') # before rop.raw(1) rop.raw(2) rop.raw(rop.ret) # after rop.raw([1, 2, rop.ret]) ``` Fixes Gallopsled#2017 * Update CHANGELOG.md * Update pwnlib/rop/rop.py Co-authored-by: Arusekk <[email protected]>
1 parent 838e9ec commit 48d76ed

File tree

1 file changed

+21
-2
lines changed

1 file changed

+21
-2
lines changed

pwnlib/rop/rop.py

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1167,32 +1167,51 @@ def find_gadget(self, instructions):
11671167
if tuple(gadget.insns)[:n] == tuple(instructions):
11681168
return gadget
11691169

1170+
def _flatten(self, initial_list):
1171+
# Flatten out any nested lists.
1172+
flattened_list = []
1173+
for data in initial_list:
1174+
if isinstance(data, (list, tuple)):
1175+
flattened_list.extend(self._flatten(data))
1176+
else:
1177+
flattened_list.append(data)
1178+
return flattened_list
11701179

11711180
def raw(self, value):
11721181
"""Adds a raw integer or string to the ROP chain.
11731182
11741183
If your architecture requires aligned values, then make
11751184
sure that any given string is aligned!
11761185
1186+
When given a list or a tuple of values, the list is
1187+
flattened before adding every item to the chain.
1188+
11771189
Arguments:
1178-
data(int/bytes): The raw value to put onto the rop chain.
1190+
data(int/bytes/list): The raw value to put onto the rop chain.
11791191
11801192
>>> context.clear(arch='i386')
11811193
>>> rop = ROP([])
11821194
>>> rop.raw('AAAAAAAA')
11831195
>>> rop.raw('BBBBBBBB')
11841196
>>> rop.raw('CCCCCCCC')
1197+
>>> rop.raw(['DDDD', 'DDDD'])
11851198
>>> print(rop.dump())
11861199
0x0000: b'AAAA' 'AAAAAAAA'
11871200
0x0004: b'AAAA'
11881201
0x0008: b'BBBB' 'BBBBBBBB'
11891202
0x000c: b'BBBB'
11901203
0x0010: b'CCCC' 'CCCCCCCC'
11911204
0x0014: b'CCCC'
1205+
0x0018: b'DDDD' 'DDDD'
1206+
0x001c: b'DDDD' 'DDDD'
11921207
"""
11931208
if self.migrated:
11941209
log.error('Cannot append to a migrated chain')
1195-
self._chain.append(value)
1210+
1211+
if isinstance(value, (list, tuple)):
1212+
self._chain.extend(self._flatten(value))
1213+
else:
1214+
self._chain.append(value)
11961215

11971216
def migrate(self, next_base):
11981217
"""Explicitly set $sp, by using a ``leave; ret`` gadget"""

0 commit comments

Comments
 (0)