class OneGadget::Fetcher::I386
Fetcher
for i386.
Private Instance Methods
candidates()
click to toggle source
Calls superclass method
OneGadget::Fetcher::Base#candidates
# File lib/one_gadget/fetchers/i386.rb, line 14 def candidates rel_sh_hex = rel_sh.to_s(16) super do |candidate| next false unless candidate.include?(rel_sh_hex) true end end
emulator()
click to toggle source
# File lib/one_gadget/fetchers/i386.rb, line 23 def emulator OneGadget::Emulators::I386.new end
global_var?(str)
click to toggle source
+@base_reg+ should always be set in resolve()
# File lib/one_gadget/fetchers/i386.rb, line 53 def global_var?(str) str.include?(@base_reg) end
got_offset()
click to toggle source
# File lib/one_gadget/fetchers/i386.rb, line 57 def got_offset File.open(file) do |f| elf = ELFTools::ELFFile.new(f) elf.segment_by_type(:dynamic).tag_by_type(:pltgot).value end end
rel_sh()
click to toggle source
# File lib/one_gadget/fetchers/i386.rb, line 64 def rel_sh @rel_sh ||= got_offset - str_offset('/bin/sh') end
resolve(processor)
click to toggle source
Calls superclass method
OneGadget::Fetcher::Base#resolve
# File lib/one_gadget/fetchers/i386.rb, line 27 def resolve(processor) # use arg(0) to fetch the GOT base register # first check if argument 0 is '/bin/sh' to prevent error arg0 = processor.argument(0) return nil unless str_bin_sh?(arg0.to_s) @base_reg = arg0.deref.obj.to_s # this should be esi or ebx.. # now we can let parent invoke "global_var?" res = super return if res.nil? # unshift GOT constraint into cons res[:constraints].unshift("#{@base_reg} is the GOT address of libc") res[:constraints].delete_if { |c| c.start_with?("writable: #{@base_reg}") } res end
str_bin_sh?(str)
click to toggle source
# File lib/one_gadget/fetchers/i386.rb, line 44 def str_bin_sh?(str) str.include?(rel_sh.to_s(16)) end
str_sh?(str)
click to toggle source
# File lib/one_gadget/fetchers/i386.rb, line 48 def str_sh?(str) str.include?((rel_sh - 5).to_s(16)) end