cargo install ropr

git clone https://github.com/Ben-Lichtman/ropr
cd ropr
cargo build --release

git clone https://github.com/Ben-Lichtman/ropr
cd ropr
cargo install --path .

USAGE:
    ropr [OPTIONS] <BINARY>

ARGS:
    <BINARY>    The path of the file to inspect

OPTIONS:
    -b, --base-pivot               Filters for gadgets which alter the base pointer
    -c, --colour <COLOUR>          Forces output to be in colour or plain text (`true` or `false`)
    -h, --help                     Print help information
    -j, --nojop                    Removes "JOP Gadgets" - these may have a controllable branch,
                                   call, etc. instead of a simple `ret` at the end
    -m, --max-instr <MAX_INSTR>    Maximum number of instructions in a gadget [default: 6]
    -n, --noisy                    Includes potentially low-quality gadgets such as prefixes,
                                   conditional branches, and near branches (will find significantly
                                   more gadgets)
    -p, --stack-pivot              Filters for gadgets which alter the stack pointer
    -r, --norop                    Removes normal "ROP Gadgets"
    -R, --regex <REGEX>            Perform a regex search on the returned gadgets for easy filtering
        --range <RANGE>            Search between address ranges (in hexadecial) eg. `0x1234-0x4567`
        --raw <RAW>                Treats the input file as a blob of code (`true` or `false`)
    -s, --nosys                    Removes syscalls and other interrupts
    -V, --version                  Print version information

❯ ropr /usr/lib/libc.so.6 -R "^mov eax, ...;" > /dev/null

==> Found 197 gadgets in 0.118 seconds

❯ ropr /usr/lib/libc.so.6 -m 2 -j -s -R "^mov eax, ...;"
0x000353e7: mov eax, eax; ret;
0x000788c8: mov eax, ecx; ret;
0x00052252: mov eax, edi; ret;
0x0003ae43: mov eax, edx; ret;
0x000353e6: mov eax, r8d; ret;
0x000788c7: mov eax, r9d; ret;

==> Found 6 gadgets in 0.046 seconds