Code

Feat/aarch64#125

Code

Merged

Kyle-Kyle merged 106 commits intomasterangr/angrop:masterfrom feat/aarch64angr/angrop:feat/aarch64Copy head branch name to clipboardJan 24, 2025

+1,525-728

Commits

Commits on Jan 16, 2025

• Add aarch64 detection

  Show description for 7d06753
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  7d06753

  Copy full SHA for 7d06753

• Basic aarch64 register setting

  Show description for f5ca80f
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  f5ca80f

  Copy full SHA for f5ca80f

• Start implementing RiscyROP gadget chaining

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  cecb6d0

  Copy full SHA for cecb6d0

• Check for constrained writes to target registers

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  f920724

  Copy full SHA for f920724

• Implement concrete chain generation

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  98a1671

  Copy full SHA for 98a1671

• Handle gadgets with conditional branches

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  9869f9a

  Copy full SHA for 9869f9a

• Prevent infinite recursion

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  e118ec0

  Copy full SHA for e118ec0

• Support printing gadgets containing jumps

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  fb5417c

  Copy full SHA for fb5417c

• Fix default argument mutation bug

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  30d277f

  Copy full SHA for 30d277f

• Optimize gadget search order

  Show description for 45ba317
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  45ba317

  Copy full SHA for 45ba317

• Limit maximum chain length

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  d6bcae2

  Copy full SHA for d6bcae2

• Increase max block size for aarch64

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  9c4f93b

  Copy full SHA for 9c4f93b

• Work around memory leak issue

  Show description for f3d7642
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  f3d7642

  Copy full SHA for f3d7642

• Catch timeout exceptions when analyzing gadgets

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  525534f

  Copy full SHA for 525534f

• Avoid gadgets with hooked addresses

  Show description for 406dd09
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  406dd09

  Copy full SHA for 406dd09

• Ensure path constraints are controllable

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  73bd54c

  Copy full SHA for 73bd54c

• Remove timeout message

  Show description for b8831d1
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  b8831d1

  Copy full SHA for b8831d1

• Restart worker processes more frequently

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  fd4fbdf

  Copy full SHA for fd4fbdf

• Don't print timeout exceptions when gadget finding

  Show description for deeb817
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  deeb817

  Copy full SHA for deeb817

• Constrain memory access addresses

  Show description for 668bec1
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  668bec1

  Copy full SHA for 668bec1

• Catch exceptions from initial symbolic execution

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  0acd6f3

  Copy full SHA for 0acd6f3

• Avoid printing timeout exceptions

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  7cba313

  Copy full SHA for 7cba313

• Set initial ip properly when concretizing chain

  Show description for 619ccf8
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  619ccf8

  Copy full SHA for 619ccf8

• Update gadget comparison for gadgets with jumps

  Show description for 56fe645
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  56fe645

  Copy full SHA for 56fe645

• Remove constrained registers from popped_regs set

  Show description for 1b33cfc
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  1b33cfc

  Copy full SHA for 1b33cfc

• Prune search tree

  Show description for eeb3d4c
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  eeb3d4c

  Copy full SHA for eeb3d4c

• Add register weight heuristic

  Show description for b391282
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  b391282

  Copy full SHA for b391282

• Limit number of instructions in gadgets

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  6b35828

  Copy full SHA for 6b35828

• Handle two regs being popped with the same value

  Show description for 25728b1
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  25728b1

  Copy full SHA for 25728b1

• Disable slow gadget filtering code

  Show description for 04b453b
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  04b453b

  Copy full SHA for 04b453b

• Integrate RiscyROP chaining algorithm into angrop

  Show description for 5954db0
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  5954db0

  Copy full SHA for 5954db0

• Reject gadgets with pc_offset >= stack_change

  Show description for 5c51b39
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  5c51b39

  Copy full SHA for 5c51b39

• Make gadget analyzer API backwards compatible

  Show description for c196262
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  c196262

  Copy full SHA for c196262

• Add function for printing assembly code of chains

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  ce24ef9

  Copy full SHA for ce24ef9

• Add usage document for the new code

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  6f3509e

  Copy full SHA for 6f3509e

• Fix syscall gadget detection

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  f664797

  Copy full SHA for f664797

• Remove broad except clauses in gadget finder

  Show description for ce772b6
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  ce772b6

  Copy full SHA for ce772b6

• Move some code that was in a loop for no reason

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  538941b

  Copy full SHA for 538941b

• Fix stack size when building the chain

  Show description for 59ae8bb
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  59ae8bb

  Copy full SHA for 59ae8bb

• Try to minimize the payload size

  Show description for d59bcf6
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  d59bcf6

  Copy full SHA for d59bcf6

• Fix bug in compatibility workaround

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  b37ceab

  Copy full SHA for b37ceab

• Document memory leak workaround

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  bf72701

  Copy full SHA for bf72701

• Disable slow gadget filtering

  Show description for db8a56f
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  db8a56f

  Copy full SHA for db8a56f

• Increase chain building timeout

  Show description for c01bb32
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  c01bb32

  Copy full SHA for c01bb32

• Only use conditional branch gadgets in RegSetter

  Show description for f69ef3a
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  f69ef3a

  Copy full SHA for f69ef3a

• Fix start address calculation

  Show description for 24e03f7
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  24e03f7

  Copy full SHA for 24e03f7

• Add tests for new chaining algorithm

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  2d7b59d

  Copy full SHA for 2d7b59d

• Set max execution steps for func call test

  Show description for 21b5a79
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  21b5a79

  Copy full SHA for 21b5a79

• Fix gadget filtering

  Show description for 9fda99f
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  9fda99f

  Copy full SHA for 9fda99f

• Make new chain builder work with RegMover

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  44ae030

  Copy full SHA for 44ae030

• Set max steps for func call tests

  Show description for c37cde9
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  c37cde9

  Copy full SHA for c37cde9

• Set chain execution max steps conservatively

  Show description for eb959b2
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  eb959b2

  Copy full SHA for eb959b2

• Prioritize minimizing payload size

  Show description for afbe7ab
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  afbe7ab

  Copy full SHA for afbe7ab

• Update tests for conditional branches

  Show description for ff77b33
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  ff77b33

  Copy full SHA for ff77b33

• Make chain jump to address after it if possible

  Show description for 1a013b3
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  1a013b3

  Copy full SHA for 1a013b3

• Update tests to check chain.next_pc_idx()

  Show description for 3d4cb0a
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  3d4cb0a

  Copy full SHA for 3d4cb0a

• Use block.pp() instead of block.capstone.pp()

  

  bkrl

  authored and

  Kyle-Kyle

  committed
  435da69

  Copy full SHA for 435da69

• Rewrite test to not rely on exact chain

  Show description for f28974c
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  f28974c

  Copy full SHA for f28974c

• Add previous BFS algorithm for concrete values

  Show description for aa9b7b8
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  aa9b7b8

  Copy full SHA for aa9b7b8

• Fix is_in_kernel check

  Show description for 4db9728
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  4db9728

  Copy full SHA for 4db9728

• Fix exception during gadget finding

  Show description for f671363
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  f671363

  Copy full SHA for f671363

• Remove unused function

  Show description for 01e054a
  

  bkrl

  authored and

  Kyle-Kyle

  committed
  01e054a

  Copy full SHA for 01e054a

• fix symbolic data handling

  Kyle-Kyle

  committed
  027a929

  Copy full SHA for 027a929

• do static analysis first before symbolic execution for performance purpose

  Kyle-Kyle

  committed
  851b3e7

  Copy full SHA for 851b3e7

• oops

  Kyle-Kyle

  committed
  1901cdf

  Copy full SHA for 1901cdf

• better handling syscall register after symbolic execution

  Kyle-Kyle

  committed
  0150c4b

  Copy full SHA for 0150c4b

• fix issues with gadget finder

  Kyle-Kyle

  committed
  aba7006

  Copy full SHA for aba7006

• fix analyze_gadget_list test case

  Kyle-Kyle

  committed
  5d374ef

  Copy full SHA for 5d374ef

• fix function calling in i386

  Kyle-Kyle

  committed
  a1fdccc

  Copy full SHA for a1fdccc

• fix function calls for lr-based calling convention

  Kyle-Kyle

  committed
  6b0b535

  Copy full SHA for 6b0b535

Commits on Jan 17, 2025

• make gadget filtering 10x faster

  Kyle-Kyle

  committed
  9bd01db

  Copy full SHA for 9bd01db

• print bad chains for easier debugging

  Kyle-Kyle

  committed
  1f25a18

  Copy full SHA for 1f25a18

• fix gadget filtering

  Kyle-Kyle

  committed
  7e2f62e

  Copy full SHA for 7e2f62e

Commits on Jan 18, 2025

• implement gadget.pp()

  Kyle-Kyle

  committed
  f5cb48e

  Copy full SHA for f5cb48e

• better pretty printing for gadget and chain

  Kyle-Kyle

  committed
  40fc842

  Copy full SHA for 40fc842

Commits on Jan 21, 2025

• make _add_gadget_value a separate function

  Kyle-Kyle

  committed
  e8c5724

  Copy full SHA for e8c5724

• use dstr and pp for chain/gadget printing

  Kyle-Kyle

  committed
  2024972

  Copy full SHA for 2024972

• fix a bug in chain constraint collection

  Kyle-Kyle

  committed
  3034747

  Copy full SHA for 3034747

• remove RiscyROP.md

  Kyle-Kyle

  committed
  356959f

  Copy full SHA for 356959f

Commits on Jan 22, 2025

• clean up reg_setter

  Kyle-Kyle

  committed
  ce4c341

  Copy full SHA for ce4c341

• execute more steps for function execution

  Kyle-Kyle

  committed
  01c8571

  Copy full SHA for 01c8571

• fix a few minor bugs in mem_writer

  Kyle-Kyle

  committed
  efb95b8

  Copy full SHA for efb95b8

• make aarch64 support only_check_near_rets

  Kyle-Kyle

  committed
  d97eba2

  Copy full SHA for d97eba2

• building memory accesses is very slow, let's check the number of accesses beforing building them

  Kyle-Kyle

  committed
  f06ebe7

  Copy full SHA for f06ebe7

• add extra_constraints instead of copying states, this way we can better utilize the solve caches in z3

  Kyle-Kyle

  committed
  d92873b

  Copy full SHA for d92873b

• filter out syscall gadgets that we don't control sysnum for

  Kyle-Kyle

  committed
  818f32b

  Copy full SHA for 818f32b

• do static analysis before stepping to reduce overhead

  Kyle-Kyle

  committed
  3a6128e

  Copy full SHA for 3a6128e

• make allow_conditional_branches under fast_mode

  Kyle-Kyle

  committed
  288c4a3

  Copy full SHA for 288c4a3

• retore gadget.project after caching the gadgets

  Kyle-Kyle

  committed
  3b8d6ce

  Copy full SHA for 3b8d6ce

• use instruction count for gadget comparison

  Kyle-Kyle

  committed
  c1a1abe

  Copy full SHA for c1a1abe

• check whether block makes sense or not after checking syscall

  Kyle-Kyle

  committed
  546ad79

  Copy full SHA for 546ad79

• cache syscall block's next block as well, or we may miss some good syscall gadgets

  Kyle-Kyle

  committed
  008bcc6

  Copy full SHA for 008bcc6

Commits on Jan 23, 2025

• don't map data on stack, we may perform modifications on the stack data so the mapping will lose track of those modifications

  Kyle-Kyle

  committed
  376dc1a

  Copy full SHA for 376dc1a

• support memory writing when the transit_type is not ret

  Kyle-Kyle

  committed
  1542030

  Copy full SHA for 1542030

• make max_block_size configured differently for each arch

  Kyle-Kyle

  committed
  33a026e

  Copy full SHA for 33a026e

• remove jump_reg, now there is only pc_reg

  Kyle-Kyle

  committed
  358dad0

  Copy full SHA for 358dad0

• oops, not every arch is 64bit

  Kyle-Kyle

  committed
  fd8efe1

  Copy full SHA for fd8efe1

• rebalance add/sub in ropvalue ast so we can track symbolic user ropvalue correctly

  Kyle-Kyle

  committed
  f5a3cf9

  Copy full SHA for f5a3cf9

• distinguish between analyze_gadget and analyze_addr

  Kyle-Kyle

  committed
  c7e2e04

  Copy full SHA for c7e2e04

Commits on Jan 24, 2025

• kyle, it is 2025, and 32bit system is still a thing

  Kyle-Kyle

  committed
  79a3bc1

  Copy full SHA for 79a3bc1

• improve the roptest_aarch64

  Kyle-Kyle

  committed
  3d204f6

  Copy full SHA for 3d204f6

• handle cases where syscall is the last instruction in an executable segment

  Kyle-Kyle

  committed
  ecff710

  Copy full SHA for ecff710

• don't leave rebase as None

  Kyle-Kyle

  committed
  2435bd6

  Copy full SHA for 2435bd6

• linting

  Kyle-Kyle

  committed
  42e35ac

  Copy full SHA for 42e35ac

• update README

  Kyle-Kyle

  committed
  38f9ab4

  Copy full SHA for 38f9ab4

• make pyright happy

  Kyle-Kyle

  committed
  bd0b233

  Copy full SHA for bd0b233