rop-tool - 一种帮助您编写二进制漏洞利用的工具

rop-tool - 一种帮助您编写二进制漏洞利用的工具
2020-03-29 11:16:55 Author: mp.weixin.qq.com(查看原文) 阅读量:99 收藏

rop-tool v2.4.2一种帮助您编写二进制漏洞利用的工具选项rop-tool v2.4.2Help you make binary exploits.Usage: rop-tool <cmd> [OPTIONS]Commands :
gadget       Search gadgets
patch       Patch the binary
info       Print info about binary
heap       Display heap structure
disassemble Disassemble the binary
search       Search on binary
help       Print help
version    Print versionTry "rop-tool help <cmd>" for more informations about a command.小工具命令Usage : rop-tool gadget [OPTIONS] [FILENAME]OPTIONS:
  --arch, -A             Select an architecture (x86, x86-64, arm, arm64)
  --all, -a             Print all gadgets (even gadgets which are not uniq)
  --depth, -d       [d]  Specify the depth for gadget searching (default is 5)
  --flavor, -f       [f]  Select a flavor (att or intel)
  --no-filter, -F       Do not apply some filters on gadgets
  --help, -h             Print this help message
  --no-color, -N          Do not colorize output搜索命令Usage : rop-tool search [OPTIONS] [FILENAME]OPTIONS:
  --all-string, -a [n]  Search all printable strings of at least [n] caracteres. (default is 6)
  --byte, -b          Search the byte  in binary
  --dword, -d       [d]  Search the dword [d] in binary
  --help, -h             Print this help message
  --no-color, -N          Don't colorize output
  --qword, -q       [q]  Search the qword [q] in binary
  --raw, -r             Open file in raw mode (don't considere any file format)
  --split-string, -s Search a string "splited" in memory (which is not contiguous in memory)
  --string, -S       Search a string (a byte sequence) in binary
  --word, -w       [w]  Search the word [w] in binary补丁命令Usage : rop-tool patch [OPTIONS] [FILENAME]OPTIONS:
  --address, -a    [a]  Select an address to patch
  --bytes, -b          A byte sequence (e.g. : "\xaa\xbb\xcc") to write
  --filename, -f    [f]  Specify the filename
  --help, -h             Print this help message
  --offset, -o       [o]  Select an offset to patch (from start of the file)
  --output, -O       [o]  Write to an another filename
  --raw, -r             Open file in raw mode信息命令Usage : rop-tool info [OPTIONS] [FILENAME]OPTIONS:
  --all, -a             Show all infos
  --segments, -l          Show segments
  --sections, -s          Show sections
  --syms, -S             Show symbols
  --filename, -f    [f]  Specify the filename
  --help, -h             Print this help message
  --no-color, -N          Disable colors取消命令Usage : rop-tool dis [OPTIONS] [FILENAME]OPTIONS:
  --help, -h             Print this help message
  --no-color, -N          Do not colorize output
  --address, -a <a>    Start disassembling at address <a>
  --offset, -o    <o>    Start disassembling at offset <o>
  --sym, -s       <s>    Disassemble symbol
  --len, -l       <l>    Disassemble only <l> bytes
  --arch, -A    <a>    Select architecture (x86, x86-64, arm, arm64)
  --flavor, -f    <f>    Change flavor (intel, att)堆命令Usage : rop-tool heap [OPTIONS] [COMMAND]OPTIONS:
  --calloc, -C          Trace calloc calls
  --free, -F             Trace free calls
  --realloc, -R          Trace realloc calls
  --malloc, -M          Trace malloc calls
  --dumpdata, -d          Dump chunk's data
  --output, -O          Output in a file
  --help, -h             Print this help message
  --tmp, -t       <d>    Specify the writable directory, to dump the library (default: /tmp/)
  --no-color, -N          Do not colorize output关于堆命令输出的小说明每行对应一个malloc块，并且在每次执行堆函数（free，malloc，realloc，calloc）之后转储堆addr：是malloc块的真实地址usr_addr：是malloc函数返回给用户的地址size：是malloc块的大小标志：P为PREV_INUSE，M为IS_MAPED，A为NON_MAIN_ARENA特征字符串搜索，小工具搜索，修补，信息，堆可视化，拆卸彩色输出英特尔和AT＆T风格支持ELF，PE和MACH-O二进制格式支持大小端支持x86，x86_64，ARM，ARM64，MIPS，MIPS64体系结构例子基本小工具搜索rop-tool gadget ./program显示所有使用AT＆T语法的小工具rop-tool gadget ./program -f att -a在RAW x86文件中搜索小工具rop-tool gadget ./program -A x86在二进制文件中搜索“分割的”字符串rop-tool search ./program -s "/bin/sh"搜索所有二进制字符串rop-tool search ./program -a使用“ \ xaa \ xbb \ xcc \ xdd”在偏移量0x1000处修补二进制文件并另存为“ patched”：rop-tool patch ./program -o 0x1000 -b "\xaa\xbb\xcc\xdd" -O patched可视化/ bin / ls命令的堆分配：rop-tool heap /bin/ls在地址0x08048452处反汇编0x100字节rop-tool dis /bin/ls -l 0x100 -a 0x08048452屏幕截图rop-tool gadget /bin/lsrop-tool search /bin/ls -arop-tool search /bin/ls -s "/bin/sh\x00"rop-tool heap ./a.outrop-tool dis ./bin  # Many formats汇编
git clone

https://github.com/t00sh/rop-tool.git
  cd rop-tool
  sh scripts/set_env.sh
  make

作者
Tosh（在t0x0sh处的Tosh。org）

【文章来源】：

https://github.com/t00sh/rop-tool

微信公众号文章素材之分割线大全