一个帮助你编写二进制漏洞利用的工具
rop-tool v2.4.2
Help you make binary exploits.
Usage: rop-tool <cmd> [OPTIONS]
Commands :
gadget Search gadgets
patch Patch the binary
info Print info about binary
heap Display heap structure
disassemble Disassemble the binary
search Search on binary
help Print help
version Print version
Try "rop-tool help <cmd>" for more informations about a command.
Usage : rop-tool gadget [OPTIONS] [FILENAME]
OPTIONS:
--arch, -A Select an architecture (x86, x86-64, arm, arm64)
--all, -a Print all gadgets (even gadgets which are not uniq)
--depth, -d [d] Specify the depth for gadget searching (default is 5)
--flavor, -f [f] Select a flavor (att or intel)
--no-filter, -F Do not apply some filters on gadgets
--help, -h Print this help message
--no-color, -N Do not colorize output
Usage : rop-tool search [OPTIONS] [FILENAME]
OPTIONS:
--all-string, -a [n] Search all printable strings of at least [n] caracteres. (default is 6)
--byte, -b [b] Search the byte [b] in binary
--dword, -d [d] Search the dword [d] in binary
--help, -h Print this help message
--no-color, -N Don't colorize output
--qword, -q [q] Search the qword [q] in binary
--raw, -r Open file in raw mode (don't considere any file format)
--split-string, -s [s] Search a string "splited" in memory (which is not contiguous in memory)
--string, -S [s] Search a string (a byte sequence) in binary
--word, -w [w] Search the word [w] in binary
Usage : rop-tool patch [OPTIONS] [FILENAME]
OPTIONS:
--address, -a [a] Select an address to patch
--bytes, -b [b] A byte sequence (e.g. : "\xaa\xbb\xcc") to write
--filename, -f [f] Specify the filename
--help, -h Print this help message
--offset, -o [o] Select an offset to patch (from start of the file)
--output, -O [o] Write to an another filename
--raw, -r Open file in raw mode
Usage : rop-tool info [OPTIONS] [FILENAME]
OPTIONS:
--all, -a Show all infos
--segments, -l Show segments
--sections, -s Show sections
--syms, -S Show symbols
--filename, -f [f] Specify the filename
--help, -h Print this help message
--no-color, -N Disable colors
Usage : rop-tool dis [OPTIONS] [FILENAME]
OPTIONS:
--help, -h Print this help message
--no-color, -N Do not colorize output
--address, -a <a> Start disassembling at address <a>
--offset, -o <o> Start disassembling at offset <o>
--sym, -s <s> Disassemble symbol
--len, -l <l> Disassemble only <l> bytes
--arch, -A <a> Select architecture (x86, x86-64, arm, arm64)
--flavor, -f <f> Change flavor (intel, att)
Usage : rop-tool heap [OPTIONS] [COMMAND]
OPTIONS:
--calloc, -C Trace calloc calls
--free, -F Trace free calls
--realloc, -R Trace realloc calls
--malloc, -M Trace malloc calls
--dumpdata, -d Dump chunk's data
--output, -O Output in a file
--help, -h Print this help message
--tmp, -t <d> Specify the writable directory, to dump the library (default: /tmp/)
--no-color, -N Do not colorize output
关于 heap 命令输出的小说明
每一行对应一个 malloc 块（chunk），并且每次执行堆函数（free, malloc, realloc, calloc）后都会转储堆内容
addr: 是 malloc 块的实际地址
usr_addr: 是 malloc 函数返回给用户的地址
size: 是 malloc 块的大小
flags: P 表示 PREV_INUSE, M 表示 IS_MAPED, A 表示 NON_MAIN_ARENA
字符串搜索、gadget 搜索、补丁、信息查看、堆可视化、反汇编
彩色输出
Intel 与 AT&T 语法风格
支持 ELF、PE 和 MACH-O 二进制格式
支持大端序和小端序
支持 x86、x86-64、ARM、ARM64、MIPS、MIPS64 架构
基础 gadget 搜索
rop-tool gadget ./program
显示所有 AT&T 语法下的 gadget
rop-tool gadget ./program -f att -a
在 RAW x86 文件中搜索 gadget
rop-tool gadget ./program -A x86
在二进制文件中搜索“分段”字符串
rop-tool search ./program -s "/bin/sh"
在二进制文件中搜索所有字符串
rop-tool search ./program -a
在偏移 0x1000 处补丁二进制文件，写入 "\xaa\xbb\xcc\xdd" 并保存为 "patched"：
rop-tool patch ./program -o 0x1000 -b "\xaa\xbb\xcc\xdd" -O patched
可视化 /bin/ls 命令的堆分配：
rop-tool heap /bin/ls
反汇编地址 0x08048452 处的 0x100 字节
rop-tool dis /bin/ls -l 0x100 -a 0x08048452
rop-tool gadget /bin/ls
rop-tool search /bin/ls -a
rop-tool search /bin/ls -s "/bin/sh\x00"
rop-tool heap ./a.out
rop-tool dis ./bin # 多种格式
git clone https://github.com/t00sh/rop-tool.git
cd rop-tool
sh scripts/set_env.sh
make
Tosh (tosh at t0x0sh . org)