Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Capstone update breaks ropgadget #2491

Open
pmondon opened this issue Oct 22, 2024 · 1 comment · May be fixed by #2492
Open

Capstone update breaks ropgadget #2491

pmondon opened this issue Oct 22, 2024 · 1 comment · May be fixed by #2492

Comments

@pmondon
Copy link

pmondon commented Oct 22, 2024

Capstone has been updated to 6.0.0a1, subsequently, pwntools isn't working (see bellow).
A working patch for me is to downgrade capstone to 5.0.3

[*] '{PATH}tenda-pwn/tendafs/bin/httpd'
    Arch:       arm-32-little
    RELRO:      No RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x8000)
[*] '{PATH}tenda-pwn/tendafs/lib/libc.so.0'
    Arch:       arm-32-little
    RELRO:      Full RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
[*] Loading gadgets for '{PATH}tenda-pwn/tendafs/bin/httpd'
Traceback (most recent call last):
  File "{PATH}tenda-pwn/attack.py", line 11, in <module>
    rop = ROP(elf)
          ^^^^^^^^
  File "{condapath}.conda/envs/pwn/lib/python3.11/site-packages/pwnlib/rop/rop.py", line 626, in __init__
    self.__load()
  File "{condapath}.conda/envs/pwn/lib/python3.11/site-packages/pwnlib/rop/rop.py", line 1356, in __load
    core.do_load(0)
  File "{condapath}.conda/envs/pwn/lib/python3.11/site-packages/ropgadget/core.py", line 307, in do_load
    self.__getGadgets()
  File "{condapath}.conda/envs/pwn/lib/python3.11/site-packages/ropgadget/core.py", line 70, in __getGadgets
    G = Gadgets(self.__binary, self.__options, self.__offset)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "{condapath}.conda/envs/pwn/lib/python3.11/site-packages/ropgadget/gadgets.py", line 24, in __init__
    elif self.__arch == CS_ARCH_ARM64:
                        ^^^^^^^^^^^^^
NameError: name 'CS_ARCH_ARM64' is not defined
@peace-maker
Copy link
Member

This only breaks when trying to load rop gadgets for aarch64 binaries btw. We only test for x86, which is why this didn't trigger in CI. I don't think the ROP class properly supports anything but x86/x86_64 too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants