Counsel rop

ROP chain in Binary Exploitation is a technique to bypass NX/DEP security patch , this makes the memory either writable or executable but not both . so injecting shellcode not work . ROP Return Oriented Programming is a technique by which we reuse the code which are there in the binary to exploit , a collection of assembly instruction which are there in the binary ending with ret or call is called gadget , chaining these gadgets in a creative way we can recreate what the shellcode does and pwn the binary .

There are many tools to find these gadget , but we need to find a way to integrate that to emacs because that is what we do .

With the help of the awesome package from abo-abo ie counsel and ivy we can create an interface for ROPgadget which is a python program to find gadget .

(defun counsel-rop (arg)
  "ROP gadget Search for a bianry"
  (interactive "file name : ")
  (progn
    (setq buffer-name (concat (file-name-base arg ) "_gadgets"))
    (if (get-buffer buffer-name) ()
      (progn
    (shell-command (concat "ROPgadget " " --binary " arg) buffer-name)
    (with-current-buffer buffer-name 
      (bury-buffer))))
    (with-current-buffer buffer-name
      (setq cantidates (split-string (buffer-string) "\n" t))
      ))
  (ivy-read " Gadget : " cantidates
        :re-builder #'ivy--regex-fuzzy
        :action #'insert
        :caller 'counsel-rop
        ))

What the above code does is that it runs the program ROPgadget and collects the output and writes it to a buffer with the name of the binary then using ivy we search this buffer to find the required gadget.

The ivy-read takes the given collection of strings and gives us a prompt to select from that collection after the selection the function specified in the action is called here it just inserted to buffer .

Before running the command it is checked that if the buffer exist if it exists, that is used otherwise a new buffer is created , this is help full when dealing with large binary , we need not run the program every time.

(ivy-set-actions
 'counsel-rop
 '(("a" (lambda (x) (insert (car (split-string x "\:")))) "Insert Address")
   ("r" (lambda (x) (insert (cdr (split-string x "\:")))) "Insert Gadget"))
 )

ivy set action is special action that we can called with the selected item , here we are using it to just insert the address if the gadget or the code . this might be handy while documentation .