ROPGADGET(1)

Okay bestie, welcome to the ROPGADGET(1) manual from the General Commands Manual 🎀✨ This tool is giving security research energy and I am OBSESSED 💅

✨ NAME ✨

ROPgadget 💖 search executables for exploitable ROP gadgets 🦋

🎀 SYNOPSIS 🎀

Here's the basic shape of the command, no cap 💅

ROPgadget [--binary FILE] [options]

🌸 DESCRIPTION 🌸

Okay so ROPGadget is a tool for security research and vulnerability exploitation 🔥 It lets you search binaries for sequences of useful machine code instructions that end in a return statement. Those are called "gadgets" 🧚

If an exploit can manipulate the callstack to point at a sequence of gadgets, the return statements redirect the program flow so it runs that sequence. That's "return oriented programming" 💜 By reusing existing code out of context, an attacker can potentially get around security measures that stop injected code from running. Lowkey iconic, highkey concerning 💀

ROPgadget supports ELF/PE/Mach-O format on x86, x64, ARM, PowerPC, SPARC and MIPS architectures 🌈

Here are the options you can play with ✨

• --binary FILE 🍓 point it at the executable you want to analyze
• --opcode OPCODES 🦋 search for particular opcodes in executable sections
• --string STRING 🎀 search for a particular string in readable sections
• --memstr STRING 🌸 search for each byte in readable sections
• --depth DEPTH 💖 limit the search depth for the internal engine (default: 10)
• --only KEY ✨ only show specific instructions
• --filter KEY 🙈 suppress specific instructions
• --range START-END 🧚 limit the search to the address range between START and END
• --badbytes BYTES 💀 reject specific bytes in the address of a gadget
• --rawArch ARCH 👑 specify the architecture for raw binaries
• --rawMode MODE 💅 specify the mode for raw binaries
• --re EXPR 🔥 search for gadgets using the regular expression EXPR
• --offsetOFFSET 🦋 add an offset to all gadget addresses
• --ropchain 💜 enable ROP chain generation
• --thumb 🌈 use thumb mode for ARM architecture binaries
• --console 🫶 enable the interactive console for the search engine
• --norop 🙈 disable the ROP search engine
• --nojop 🙈 disable the JOP search engine
• --nosys 🙈 disable the SYS search engine
• --multibr ⭐ enable multiple branch gadgets
• --all 👑 show all gadgets, even duplicates
• --dump 🍓 output the gadget bytes

⚠️ Bestie, this is powerful stuff, so use it responsibly and only on things you're allowed to analyze 🫶

🦋 AUTHOR 🦋

This manual page was written for Debian by Timo Röhling and may be used without restriction 💜

That's the whole tea, bestie 🫶 ROPGADGET(1) signing off 🌈✨