class OneGadget::Fetcher::I386

Fetcher for i386.

Private Instance Methods

candidates() click to toggle source
Calls superclass method OneGadget::Fetcher::Base#candidates
# File lib/one_gadget/fetchers/i386.rb, line 14
def candidates
  rel_sh_hex = rel_sh.to_s(16)
  super do |candidate|
    next false unless candidate.include?(rel_sh_hex)

    true
  end
end
emulator() click to toggle source
# File lib/one_gadget/fetchers/i386.rb, line 23
def emulator
  OneGadget::Emulators::I386.new
end
global_var?(str) click to toggle source

+@base_reg+ should always be set in resolve()

# File lib/one_gadget/fetchers/i386.rb, line 53
def global_var?(str)
  str.include?(@base_reg)
end
got_offset() click to toggle source
# File lib/one_gadget/fetchers/i386.rb, line 57
def got_offset
  File.open(file) do |f|
    elf = ELFTools::ELFFile.new(f)
    elf.segment_by_type(:dynamic).tag_by_type(:pltgot).value
  end
end
rel_sh() click to toggle source
# File lib/one_gadget/fetchers/i386.rb, line 64
def rel_sh
  @rel_sh ||= got_offset - str_offset('/bin/sh')
end
resolve(processor) click to toggle source
Calls superclass method OneGadget::Fetcher::Base#resolve
# File lib/one_gadget/fetchers/i386.rb, line 27
def resolve(processor)
  # use arg(0) to fetch the GOT base register
  # first check if argument 0 is '/bin/sh' to prevent error
  arg0 = processor.argument(0)
  return nil unless str_bin_sh?(arg0.to_s)

  @base_reg = arg0.deref.obj.to_s # this should be esi or ebx..
  # now we can let parent invoke "global_var?"
  res = super
  return if res.nil?

  # unshift GOT constraint into cons
  res[:constraints].unshift("#{@base_reg} is the GOT address of libc")
  res[:constraints].delete_if { |c| c.start_with?("writable: #{@base_reg}") }
  res
end
str_bin_sh?(str) click to toggle source
# File lib/one_gadget/fetchers/i386.rb, line 44
def str_bin_sh?(str)
  str.include?(rel_sh.to_s(16))
end
str_sh?(str) click to toggle source
# File lib/one_gadget/fetchers/i386.rb, line 48
def str_sh?(str)
  str.include?((rel_sh - 5).to_s(16))
end