one_gadget 1.10.0 → 2.0.0

data/README.md

@@ -1,9 +1,10 @@
+[![Downloads](https://img.shields.io/gem/dt/one_gadget)](https://rubygems.org/gems/one_gadget)
+
+
 [![Gem Version](https://badge.fury.io/rb/one_gadget.svg)](https://badge.fury.io/rb/one_gadget)
 [![Build Status](https://github.com/david942j/one_gadget/workflows/build/badge.svg)](https://github.com/david942j/one_gadget/actions)
-[![Downloads](http://ruby-gem-downloads-badge.herokuapp.com/one_gadget?type=total&color=orange)](https://rubygems.org/gems/one_gadget)
-[![Code Climate](https://codeclimate.com/github/david942j/one_gadget/badges/gpa.svg)](https://codeclimate.com/github/david942j/one_gadget)
-[![Issue Count](https://codeclimate.com/github/david942j/one_gadget/badges/issue_count.svg)](https://codeclimate.com/github/david942j/one_gadget)
-[![Test Coverage](https://codeclimate.com/github/david942j/one_gadget/badges/coverage.svg)](https://codeclimate.com/github/david942j/one_gadget/coverage)
+[![Maintainability](https://qlty.sh/gh/david942j/projects/one_gadget/maintainability.svg)](https://qlty.sh/gh/david942j/projects/one_gadget)
+[![Code Coverage](https://qlty.sh/gh/david942j/projects/one_gadget/coverage.svg)](https://qlty.sh/gh/david942j/projects/one_gadget)
 [![Inline docs](https://inch-ci.org/github/david942j/one_gadget.svg?branch=master)](https://inch-ci.org/github/david942j/one_gadget)
 [![Yard Docs](http://img.shields.io/badge/yard-docs-blue.svg)](https://www.rubydoc.info/github/david942j/one_gadget/)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg)](http://choosealicense.com/licenses/mit/)
@@ -31,13 +32,35 @@ Note: requires ruby version >= 2.1.0, you can use `ruby --version` to check.
 - [x] i386
 - [x] amd64 (x86-64)
 - [x] aarch64 (ARMv8)
+- [x] arm (ARMv7, A32/Thumb-2)
 
 ## Implementation
 
 OneGadget uses symbolic execution to find the constraints of gadgets to be successful.
 
+Gadgets are found by walking the control-flow graph backward from each `exec`/`posix_spawn`
+call, following conditional branches both ways. When a gadget is only reachable if a branch is
+(not) taken, that decision shows up as an extra constraint, e.g. `x2 == 0x1`.
+
 The article introducing how I develop this tool can be found [on my blog](https://david942j.blogspot.com/2017/02/project-one-gadget-in-glibc.html).
 
+### Checked by running them
+
+Constraints are only worth as much as they are complete, so the gadgets this repository
+ships are verified by being run. [Aletheia](aletheia/README.md) loads the libc in a live
+process, arranges exactly what a gadget's constraints ask for, poisons every register and
+page they *don't* mention, jumps to the offset, and requires a real `/bin/sh` to come back
+and list the root directory. A gadget whose constraint list is missing something fails
+there instead of passing by luck -- which is how several missing constraints were found.
+
+```bash
+bundle exec rake aletheia:verify                # every libc under spec/data, level 0
+bundle exec rake "aletheia:verify[1, aarch64]"  # one output level, one architecture
+```
+
+Aletheia is development tooling: it lives outside `lib/` and `bin/`, so it is not part of
+the published gem.
+
 ## Usage
 
 ### Command Line Interface
@@ -52,7 +75,9 @@ $ one_gadget
 #                                      Increase this level to ask OneGadget show more gadgets it found.
 #                                      Default: 0
 #     -n, --near FUNCTIONS/FILE        Order gadgets by their distance to the given functions or to the GOT functions of the given file.
-#     -r, --[no-]raw                   Output gadgets offset only, split with one space.
+#     -o, --output-format FORMAT       Output format. FORMAT should be one of <pretty|raw|json>.
+#                                      Default: pretty
+#     -r, --raw                        Alias of -o raw. Output gadgets offset only, split with one space.
 #     -s, --script exploit-script      Run exploit script with all possible gadgets.
 #                                      The script will be run as 'exploit-script $offset'.
 #         --info BuildID               Show version information given BuildID.
@@ -63,43 +88,58 @@ $ one_gadget
 ```
 
 ```bash
-$ one_gadget /lib/x86_64-linux-gnu/libc.so.6
-# 0xe3afe execve("/bin/sh", r15, r12)
-# constraints:
-#   [r15] == NULL || r15 == NULL || r15 is a valid argv
-#   [r12] == NULL || r12 == NULL || r12 is a valid envp
-#
-# 0xe3b01 execve("/bin/sh", r15, rdx)
+$ one_gadget spec/data/libc-2.31-9fdb74e7b217d06c93172a8243f8547f947ee6d1.so
+# 0xe3b31 execve("/bin/sh", r15, rdx)
 # constraints:
 #   [r15] == NULL || r15 == NULL || r15 is a valid argv
 #   [rdx] == NULL || rdx == NULL || rdx is a valid envp
 #
-# 0xe3b04 execve("/bin/sh", rsi, rdx)
+# 0xe3b34 execve("/bin/sh", rsi, rdx)
 # constraints:
 #   [rsi] == NULL || rsi == NULL || rsi is a valid argv
 #   [rdx] == NULL || rdx == NULL || rdx is a valid envp
+#
+# 0xe3c20 execve("/bin/sh", r15, r12)
+# constraints:
+#   [r15] == NULL || r15 == NULL || r15 is a valid argv
+#   [r12] == NULL || r12 == NULL || r12 is a valid envp
+#
+# 0x107cea posix_spawn(rsp+0x64, "/bin/sh", [rsp+0x38], 0, rsp+0x70, environ)
+# constraints:
+#   [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv
+#   [rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0x0
 
 ```
 ![x86_64](https://github.com/david942j/one_gadget/blob/master/examples/x86_64.png?raw=true)
 
 #### Given BuildID
 ```bash
-$ one_gadget -b aad7dbe330f23ea00ca63daf793b766b51aceb5d
-# 0x4557a execve("/bin/sh", rsp+0x30, environ)
+$ one_gadget -b b417c0ba7cc5cf06d1d1bed6652cedb9253c60d0
+# 0x4f322 execve("/bin/sh", rsp+0x40, environ)
 # constraints:
-#   [rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv
+#   [rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv
 #
-# 0xf1651 execve("/bin/sh", rsp+0x40, environ)
+# 0xe56d8 execve("/bin/sh", r14, r12)
 # constraints:
-#   [rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv
+#   [r14] == NULL || r14 == NULL || r14 is a valid argv
+#   [r12] == NULL || r12 == NULL || r12 is a valid envp
 #
-# 0xf24cb execve("/bin/sh", rsp+0x60, environ)
+# 0xe5863 execve("/bin/sh", r10, rdx)
 # constraints:
-#   [rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv
+#   [r10] == NULL || r10 == NULL || r10 is a valid argv
+#   [rdx] == NULL || rdx == NULL || rdx is a valid envp
+#
+# 0x10a38c execve("/bin/sh", rsp+0x70, environ)
+# constraints:
+#   [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv
 
 ```
 ![build id](https://github.com/david942j/one_gadget/blob/master/examples/from_build_id.png?raw=true)
 
+The gem carries the gadgets of the libcs most likely to be asked for -- the glibc of
+every Ubuntu LTS still in standard support, and every libc the tests cover. Any other
+BuildID is fetched from this repository, which keeps them all.
+
 #### Gadgets Near Functions
 
 ##### Why
@@ -117,38 +157,48 @@ you will have at least 1/16 chance of success.
 Reorder gadgets according to the distance of given functions.
 
 ```bash
-$ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --near exit,mkdir
-# [OneGadget] Gadgets near exit(0x46a40):
-# 0xe3afe execve("/bin/sh", r15, r12)
-# constraints:
-#   [r15] == NULL || r15 == NULL || r15 is a valid argv
-#   [r12] == NULL || r12 == NULL || r12 is a valid envp
-#
-# 0xe3b01 execve("/bin/sh", r15, rdx)
+$ one_gadget spec/data/libc-2.31-9fdb74e7b217d06c93172a8243f8547f947ee6d1.so --near exit,mkdir
+# [OneGadget] Gadgets near exit(0x46a70):
+# 0xe3b31 execve("/bin/sh", r15, rdx)
 # constraints:
 #   [r15] == NULL || r15 == NULL || r15 is a valid argv
 #   [rdx] == NULL || rdx == NULL || rdx is a valid envp
 #
-# 0xe3b04 execve("/bin/sh", rsi, rdx)
+# 0xe3b34 execve("/bin/sh", rsi, rdx)
 # constraints:
 #   [rsi] == NULL || rsi == NULL || rsi is a valid argv
 #   [rdx] == NULL || rdx == NULL || rdx is a valid envp
 #
-# [OneGadget] Gadgets near mkdir(0x10de70):
-# 0xe3b04 execve("/bin/sh", rsi, rdx)
+# 0xe3c20 execve("/bin/sh", r15, r12)
 # constraints:
-#   [rsi] == NULL || rsi == NULL || rsi is a valid argv
-#   [rdx] == NULL || rdx == NULL || rdx is a valid envp
+#   [r15] == NULL || r15 == NULL || r15 is a valid argv
+#   [r12] == NULL || r12 == NULL || r12 is a valid envp
 #
-# 0xe3b01 execve("/bin/sh", r15, rdx)
+# 0x107cea posix_spawn(rsp+0x64, "/bin/sh", [rsp+0x38], 0, rsp+0x70, environ)
+# constraints:
+#   [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv
+#   [rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0x0
+#
+# [OneGadget] Gadgets near mkdir(0x10dc80):
+# 0x107cea posix_spawn(rsp+0x64, "/bin/sh", [rsp+0x38], 0, rsp+0x70, environ)
+# constraints:
+#   [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv
+#   [rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0x0
+#
+# 0xe3c20 execve("/bin/sh", r15, r12)
 # constraints:
 #   [r15] == NULL || r15 == NULL || r15 is a valid argv
+#   [r12] == NULL || r12 == NULL || r12 is a valid envp
+#
+# 0xe3b34 execve("/bin/sh", rsi, rdx)
+# constraints:
+#   [rsi] == NULL || rsi == NULL || rsi is a valid argv
 #   [rdx] == NULL || rdx == NULL || rdx is a valid envp
 #
-# 0xe3afe execve("/bin/sh", r15, r12)
+# 0xe3b31 execve("/bin/sh", r15, rdx)
 # constraints:
 #   [r15] == NULL || r15 == NULL || r15 is a valid argv
-#   [r12] == NULL || r12 == NULL || r12 is a valid envp
+#   [rdx] == NULL || rdx == NULL || rdx is a valid envp
 #
 
 ```
@@ -156,306 +206,283 @@ $ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --near exit,mkdir
 
 Regular expression is acceptable.
 ```bash
-$ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --near 'write.*' --raw
-# [OneGadget] Gadgets near writev(0x114690):
-# 932612 932609 932606
+$ one_gadget spec/data/libc-2.31-9fdb74e7b217d06c93172a8243f8547f947ee6d1.so --near 'write.*' --raw
+# [OneGadget] Gadgets near writev(0x1144a0):
+# 1080554 932896 932660 932657
 #
-# [OneGadget] Gadgets near write(0x10e280):
-# 932612 932609 932606
+# [OneGadget] Gadgets near write(0x10e090):
+# 1080554 932896 932660 932657
 #
 
 ```
 
 Pass an ELF file as the argument, OneGadget will take all GOT functions for processing.
 ```bash
-$ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --near spec/data/test_near_file.elf --raw
-# [OneGadget] Gadgets near exit(0x46a40):
-# 932606 932609 932612
+$ one_gadget spec/data/libc-2.31-9fdb74e7b217d06c93172a8243f8547f947ee6d1.so --near spec/data/test_near_file.elf --raw
+# [OneGadget] Gadgets near exit(0x46a70):
+# 932657 932660 932896 1080554
 #
-# [OneGadget] Gadgets near puts(0x84420):
-# 932606 932609 932612
+# [OneGadget] Gadgets near puts(0x84450):
+# 932657 932660 932896 1080554
 #
-# [OneGadget] Gadgets near printf(0x61c90):
-# 932606 932609 932612
+# [OneGadget] Gadgets near printf(0x61cc0):
+# 932657 932660 932896 1080554
 #
-# [OneGadget] Gadgets near strlen(0x9f630):
-# 932606 932609 932612
+# [OneGadget] Gadgets near strlen(0x9f660):
+# 932657 932660 932896 1080554
 #
-# [OneGadget] Gadgets near __cxa_finalize(0x46f10):
-# 932606 932609 932612
+# [OneGadget] Gadgets near __cxa_finalize(0x46f40):
+# 932657 932660 932896 1080554
 #
-# [OneGadget] Gadgets near __libc_start_main(0x23f90):
-# 932606 932609 932612
+# [OneGadget] Gadgets near __libc_start_main(0x23fc0):
+# 932657 932660 932896 1080554
 #
 
 ```
 
-#### Show All Gadgets
+#### Show More Gadgets
+
+A libc holds far more gadgets than fit on a screen, and most of them ask more of you
+than a handful of others do. `--level` chooses how much of what was found to show.
 
-Sometimes `one_gadget` finds too many gadgets to show them in one screen,
-by default gadgets would be filtered automatically *according to the difficulty of constraints*.
+| Level | Shows | Use it when |
+| --- | --- | --- |
+| `0` (default) | the few gadgets whose constraints are easiest to arrange | always, first |
+| `1` | every gadget, one line per address, minus any that asks for everything an easier one asks for and more | none of the level-0 gadgets fit what you control |
+| `2` | everything found, including an address listed once per set of constraints it can be reached under | you want to see every way in, including the awkward ones |
 
-Use option `--level 1` to show all gadgets found instead of only those with higher probabilities.
+Level 1 drops a gadget when an easier one already asks for everything it does; level 0
+then scores what is left by how hard its constraints look and keeps only the best few;
+level 2 drops nothing. On the glibc 2.31 below that is 4, 32 and 97 entries -- the last
+over 96 addresses, since one of them is reachable two ways with different requirements.
+
+Level 2 reads the libc you point at directly, where the levels below it answer from the
+pre-built gadget database when it knows the file's BuildID -- the same gadgets either
+way. Pass `-f` to search the file at every level.
 
 ```bash
-$ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --level 1
-# 0x51dfb posix_spawn(rsp+0xc, "/bin/sh", 0, rbp, rsp+0x50, environ)
+$ one_gadget spec/data/libc-2.31-9fdb74e7b217d06c93172a8243f8547f947ee6d1.so --level 1
+# 0x51df8 posix_spawn(rsp+0xc, "/bin/sh", 0, rsp+0x210, rsp+0x50, environ)
+# constraints:
+#   readable: r12
+#   readable: r13
+#   rsp & 0xf == 0x0
+#   {"sh", "-c", rbx, NULL} is a valid argv
+#   rsp+0x210 == NULL || (u16)[rsp+0x210] == 0x0
+#
+# 0x51e2b posix_spawn(rsp+0xc, "/bin/sh", 0, rbp, rsp+0x50, environ)
 # constraints:
-#   address rsp+0x60 is writable
-#   rsp & 0xf == 0
+#   rsp & 0xf == 0x0
 #   {"sh", "-c", rbx, NULL} is a valid argv
-#   rbp == NULL || (u16)[rbp] == NULL
+#   rbp == NULL || (u16)[rbp] == 0x0
 #
-# 0x51e02 posix_spawn(rsp+0xc, "/bin/sh", 0, rbp, rsp+0x50, environ)
+# 0x51e32 posix_spawn(rsp+0xc, "/bin/sh", 0, rbp, rsp+0x50, environ)
 # constraints:
-#   address rsp+0x60 is writable
-#   rsp & 0xf == 0
+#   rsp & 0xf == 0x0
 #   rax == NULL || {"sh", rax, rbx, NULL} is a valid argv
-#   rbp == NULL || (u16)[rbp] == NULL
+#   rbp == NULL || (u16)[rbp] == 0x0
 #
-# 0x51e09 posix_spawn(rsp+0xc, "/bin/sh", 0, rbp, rsp+0x50, environ)
+# 0x51e39 posix_spawn(rsp+0xc, "/bin/sh", 0, rbp, rsp+0x50, environ)
 # constraints:
-#   address rsp+0x60 is writable
-#   rsp & 0xf == 0
+#   rsp & 0xf == 0x0
 #   rcx == NULL || {rcx, rax, rbx, NULL} is a valid argv
-#   rbp == NULL || (u16)[rbp] == NULL
+#   rbp == NULL || (u16)[rbp] == 0x0
 #
-# 0x51e10 posix_spawn(rsp+0xc, "/bin/sh", rdx, rbp, rsp+0x50, environ)
+# 0x51e40 posix_spawn(rsp+0xc, "/bin/sh", rdx, rbp, rsp+0x50, environ)
 # constraints:
-#   address rsp+0x60 is writable
-#   rsp & 0xf == 0
+#   rsp & 0xf == 0x0
 #   rcx == NULL || {rcx, (u64)xmm1, rbx, NULL} is a valid argv
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
-#   rbp == NULL || (u16)[rbp] == NULL
+#   rdx == NULL || (s32)[rdx+0x4] <= 0x0
+#   rbp == NULL || (u16)[rbp] == 0x0
 #
-# 0x51e15 posix_spawn(rsp+0xc, "/bin/sh", rdx, rbp, rsp+0x50, environ)
+# 0x51e45 posix_spawn(rsp+0xc, "/bin/sh", rdx, rbp, rsp+0x50, environ)
 # constraints:
-#   address rsp+0x60 is writable
-#   rsp & 0xf == 0
+#   rsp & 0xf == 0x0
 #   (u64)xmm0 == NULL || {(u64)xmm0, (u64)xmm1, rbx, NULL} is a valid argv
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
-#   rbp == NULL || (u16)[rbp] == NULL
+#   rdx == NULL || (s32)[rdx+0x4] <= 0x0
+#   rbp == NULL || (u16)[rbp] == 0x0
 #
-# 0x51e25 posix_spawn(rdi, "/bin/sh", rdx, rbp, rsp+0x50, [rax])
+# 0x51e55 posix_spawn(rdi, "/bin/sh", rdx, rbp, rsp+0x50, [rax])
 # constraints:
-#   address rsp+0x60 is writable
-#   rsp & 0xf == 0
+#   readable: rax
+#   rsp & 0xf == 0x0
 #   (u64)xmm0 == NULL || {(u64)xmm0, (u64)(xmm0 >> 64), rbx, NULL} is a valid argv
 #   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp
 #   rdi == NULL || writable: rdi
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
-#   rbp == NULL || (u16)[rbp] == NULL
+#   rdx == NULL || (s32)[rdx+0x4] <= 0x0
+#   rbp == NULL || (u16)[rbp] == 0x0
 #
-# 0x51e2a posix_spawn(rdi, "/bin/sh", rdx, rbp, r8, [rax])
+# 0x51e5a posix_spawn(rdi, "/bin/sh", rdx, rbp, r8, [rax])
 # constraints:
-#   address rsp+0x60 is writable
-#   rsp & 0xf == 0
+#   readable: rax
+#   rsp & 0xf == 0x0
 #   [r8] == NULL || r8 is a valid argv
 #   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp
 #   rdi == NULL || writable: rdi
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
-#   rbp == NULL || (u16)[rbp] == NULL
+#   rdx == NULL || (s32)[rdx+0x4] <= 0x0
+#   rbp == NULL || (u16)[rbp] == 0x0
 #
-# 0x51e2d posix_spawn(rdi, "/bin/sh", rdx, rcx, r8, [rax])
+# 0x84165 posix_spawn(rbx+0xe0, "/bin/sh", r12, 0, rsp+0x60, environ)
 # constraints:
-#   address rsp+0x60 is writable
-#   rsp & 0xf == 0
-#   [r8] == NULL || r8 is a valid argv
-#   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp
-#   rdi == NULL || writable: rdi
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
-#   rcx == NULL || (u16)[rcx] == NULL
-#
-# 0x51e32 posix_spawn(rdi, "/bin/sh", rdx, rcx, r8, [rax])
-# constraints:
-#   address rsp+0x68 is writable
-#   rsp & 0xf == 0
-#   [r8] == NULL || r8 is a valid argv
-#   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp
-#   rdi == NULL || writable: rdi
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
-#   rcx == NULL || (u16)[rcx] == NULL
-#
-# 0x84135 posix_spawn(rbx+0xe0, "/bin/sh", r12, 0, rsp+0x60, environ)
-# constraints:
-#   address rsp+0x70 is writable
-#   rsp & 0xf == 0
+#   rsp & 0xf == 0x0
 #   {"sh", "-c", rbp, NULL} is a valid argv
 #   rbx+0xe0 == NULL || writable: rbx+0xe0
-#   r12 == NULL || (s32)[r12+0x4] <= 0
+#   r12 == NULL || (s32)[r12+0x4] <= 0x0
 #
-# 0x8413c posix_spawn(rbx+0xe0, "/bin/sh", r12, 0, rsp+0x60, environ)
+# 0x8416c posix_spawn(rbx+0xe0, "/bin/sh", r12, 0, rsp+0x60, environ)
 # constraints:
-#   address rsp+0x70 is writable
-#   rsp & 0xf == 0
+#   rsp & 0xf == 0x0
 #   rax == NULL || {"sh", rax, rbp, NULL} is a valid argv
 #   rbx+0xe0 == NULL || writable: rbx+0xe0
-#   r12 == NULL || (s32)[r12+0x4] <= 0
+#   r12 == NULL || (s32)[r12+0x4] <= 0x0
 #
-# 0x84143 posix_spawn(rbx+0xe0, "/bin/sh", r12, 0, rsp+0x60, environ)
+# 0x84173 posix_spawn(rbx+0xe0, "/bin/sh", r12, 0, rsp+0x60, environ)
 # constraints:
-#   address rsp+0x70 is writable
-#   rsp & 0xf == 0
+#   rsp & 0xf == 0x0
 #   rcx == NULL || {rcx, rax, rbp, NULL} is a valid argv
 #   rbx+0xe0 == NULL || writable: rbx+0xe0
-#   r12 == NULL || (s32)[r12+0x4] <= 0
+#   r12 == NULL || (s32)[r12+0x4] <= 0x0
 #
-# 0x84146 posix_spawn(rbx+0xe0, "/bin/sh", rdx, 0, rsp+0x60, environ)
+# 0x84176 posix_spawn(rbx+0xe0, "/bin/sh", rdx, 0, rsp+0x60, environ)
 # constraints:
-#   address rsp+0x70 is writable
-#   rsp & 0xf == 0
+#   rsp & 0xf == 0x0
 #   rcx == NULL || {rcx, rax, rbp, NULL} is a valid argv
 #   rbx+0xe0 == NULL || writable: rbx+0xe0
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
+#   rdx == NULL || (s32)[rdx+0x4] <= 0x0
 #
-# 0x8414b posix_spawn(rbx+0xe0, "/bin/sh", rdx, 0, rsp+0x60, environ)
+# 0x8417b posix_spawn(rbx+0xe0, "/bin/sh", rdx, 0, rsp+0x60, environ)
 # constraints:
-#   address rsp+0x78 is writable
-#   rsp & 0xf == 0
+#   rsp & 0xf == 0x0
 #   rcx == NULL || {rcx, rax, [rsp+0x70], NULL} is a valid argv
 #   rbx+0xe0 == NULL || writable: rbx+0xe0
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
+#   rdx == NULL || (s32)[rdx+0x4] <= 0x0
 #
-# 0x84150 posix_spawn(rbx+0xe0, "/bin/sh", rdx, 0, rsp+0x60, environ)
+# 0x84180 posix_spawn(rbx+0xe0, "/bin/sh", rdx, 0, rsp+0x60, environ)
 # constraints:
-#   address rsp+0x78 is writable
-#   rsp & 0xf == 0
+#   rsp & 0xf == 0x0
 #   rcx == NULL || {rcx, (u64)xmm1, [rsp+0x70], NULL} is a valid argv
 #   rbx+0xe0 == NULL || writable: rbx+0xe0
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
+#   rdx == NULL || (s32)[rdx+0x4] <= 0x0
 #
-# 0x8415c posix_spawn(rbx+0xe0, "/bin/sh", rdx, 0, rsp+0x60, [rax])
+# 0x8418c posix_spawn(rbx+0xe0, "/bin/sh", rdx, 0, rsp+0x60, [rax])
 # constraints:
-#   address rsp+0x78 is writable
-#   rsp & 0xf == 0
+#   readable: rax
+#   rsp & 0xf == 0x0
 #   (u64)xmm0 == NULL || {(u64)xmm0, (u64)xmm1, [rsp+0x70], NULL} is a valid argv
 #   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp
 #   rbx+0xe0 == NULL || writable: rbx+0xe0
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
+#   rdx == NULL || (s32)[rdx+0x4] <= 0x0
 #
-# 0x84162 posix_spawn(rbx+0xe0, "/bin/sh", rdx, rcx, rsp+0x60, [rax])
+# 0x84192 posix_spawn(rbx+0xe0, "/bin/sh", rdx, rcx, rsp+0x60, [rax])
 # constraints:
-#   address rsp+0x78 is writable
-#   rsp & 0xf == 0
+#   readable: rax
+#   rsp & 0xf == 0x0
 #   (u64)xmm0 == NULL || {(u64)xmm0, (u64)(xmm0 >> 64), [rsp+0x70], NULL} is a valid argv
 #   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp
 #   rbx+0xe0 == NULL || writable: rbx+0xe0
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
-#   rcx == NULL || (u16)[rcx] == NULL
+#   rdx == NULL || (s32)[rdx+0x4] <= 0x0
+#   rcx == NULL || (u16)[rcx] == 0x0
 #
-# 0x84169 posix_spawn(rdi, "/bin/sh", rdx, rcx, rsp+0x60, [rax])
+# 0x84199 posix_spawn(rdi, "/bin/sh", rdx, rcx, rsp+0x60, [rax])
 # constraints:
-#   address rsp+0x78 is writable
-#   rsp & 0xf == 0
+#   readable: rax
+#   rsp & 0xf == 0x0
 #   (u64)xmm0 == NULL || {(u64)xmm0, (u64)(xmm0 >> 64), [rsp+0x70], NULL} is a valid argv
 #   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp
 #   rdi == NULL || writable: rdi
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
-#   rcx == NULL || (u16)[rcx] == NULL
+#   rdx == NULL || (s32)[rdx+0x4] <= 0x0
+#   rcx == NULL || (u16)[rcx] == 0x0
 #
-# 0x84170 posix_spawn(rdi, "/bin/sh", rdx, rcx, r8, [rax])
+# 0x841a0 posix_spawn(rdi, "/bin/sh", rdx, rcx, r8, [rax])
 # constraints:
-#   address rsp+0x78 is writable
-#   rsp & 0xf == 0
+#   readable: rax
+#   rsp & 0xf == 0x0
 #   [r8] == NULL || r8 is a valid argv
 #   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp
 #   rdi == NULL || writable: rdi
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
-#   rcx == NULL || (u16)[rcx] == NULL
-#
-# 0xe3afe execve("/bin/sh", r15, r12)
-# constraints:
-#   [r15] == NULL || r15 == NULL || r15 is a valid argv
-#   [r12] == NULL || r12 == NULL || r12 is a valid envp
+#   rdx == NULL || (s32)[rdx+0x4] <= 0x0
+#   rcx == NULL || (u16)[rcx] == 0x0
 #
-# 0xe3b01 execve("/bin/sh", r15, rdx)
+# 0xe3b31 execve("/bin/sh", r15, rdx)
 # constraints:
 #   [r15] == NULL || r15 == NULL || r15 is a valid argv
 #   [rdx] == NULL || rdx == NULL || rdx is a valid envp
 #
-# 0xe3b04 execve("/bin/sh", rsi, rdx)
+# 0xe3b34 execve("/bin/sh", rsi, rdx)
 # constraints:
 #   [rsi] == NULL || rsi == NULL || rsi is a valid argv
 #   [rdx] == NULL || rdx == NULL || rdx is a valid envp
 #
-# 0xe3cf3 execve("/bin/sh", r10, r12)
+# 0xe3c20 execve("/bin/sh", r15, r12)
 # constraints:
-#   address rbp-0x78 is writable
-#   [r10] == NULL || r10 == NULL || r10 is a valid argv
+#   [r15] == NULL || r15 == NULL || r15 is a valid argv
 #   [r12] == NULL || r12 == NULL || r12 is a valid envp
 #
-# 0xe3cf6 execve("/bin/sh", r10, rdx)
+# 0xe3d26 execve("/bin/sh", r10, rdx)
 # constraints:
 #   address rbp-0x78 is writable
 #   [r10] == NULL || r10 == NULL || r10 is a valid argv
 #   [rdx] == NULL || rdx == NULL || rdx is a valid envp
 #
-# 0xe3d62 execve("/bin/sh", rbp-0x50, r12)
+# 0xe3d88 execve("/bin/sh", [rbp-0x78], r12)
 # constraints:
-#   address rbp-0x48 is writable
-#   r13 == NULL || {"/bin/sh", r13, NULL} is a valid argv
+#   address rbp-0x78 is writable
+#   [[rbp-0x78]] == NULL || [rbp-0x78] == NULL || [rbp-0x78] is a valid argv
 #   [r12] == NULL || r12 == NULL || r12 is a valid envp
 #
-# 0xe3d69 execve("/bin/sh", rbp-0x50, r12)
+# 0xe3d90 execve("/bin/sh", r10, r12)
 # constraints:
-#   address rbp-0x48 is writable
-#   rax == NULL || {rax, r13, NULL} is a valid argv
+#   address rbp-0x78 is writable
+#   [r10] == NULL || r10 == NULL || r10 is a valid argv
 #   [r12] == NULL || r12 == NULL || r12 is a valid envp
 #
-# 0xe3d70 execve("/bin/sh", rbp-0x50, r12)
+# 0xe3d92 execve("/bin/sh", rbp-0x50, r12)
 # constraints:
 #   address rbp-0x50 is writable
-#   rax == NULL || {rax, [rbp-0x48], NULL} is a valid argv
+#   r13 == NULL || {"/bin/sh", r13, NULL} is a valid argv
 #   [r12] == NULL || r12 == NULL || r12 is a valid envp
 #
-# 0xe3da7 execve("/bin/sh", rbp-0x50, r12)
+# 0xe3d99 execve("/bin/sh", rbp-0x50, r12)
 # constraints:
 #   address rbp-0x50 is writable
-#   [rbp-0x68] == NULL || {"/bin/sh", [rbp-0x68], NULL} is a valid argv
+#   rax == NULL || {rax, r13, NULL} is a valid argv
 #   [r12] == NULL || r12 == NULL || r12 is a valid envp
 #
-# 0xe3db1 execve("/bin/sh", rbp-0x50, r12)
+# 0xe3da0 execve("/bin/sh", rbp-0x50, r12)
 # constraints:
 #   address rbp-0x50 is writable
-#   rax == NULL || {rax, [rbp-0x68], NULL} is a valid argv
+#   rax == NULL || {rax, [rbp-0x48], NULL} is a valid argv
 #   [r12] == NULL || r12 == NULL || r12 is a valid envp
 #
-# 0xe3db5 execve("/bin/sh", r10, r12)
+# 0xe3dd7 execve("/bin/sh", rbp-0x50, r12)
 # constraints:
-#   addresses r10+0x10, rbp-0x50 are writable
-#   [r10] == NULL || r10 == NULL || r10 is a valid argv
+#   address rbp-0x78 is writable
+#   [rbp-0x68] == NULL || {"/bin/sh", [rbp-0x68], NULL} is a valid argv
 #   [r12] == NULL || r12 == NULL || r12 is a valid envp
 #
-# 0xe3dbd execve("/bin/sh", r10, r12)
+# 0xe3de1 execve("/bin/sh", rbp-0x50, r12)
 # constraints:
-#   addresses r10+0x10, rbp-0x48 are writable
-#   [r10] == NULL || r10 == NULL || r10 is a valid argv
+#   address rbp-0x78 is writable
+#   rax == NULL || {rax, [rbp-0x68], NULL} is a valid argv
 #   [r12] == NULL || r12 == NULL || r12 is a valid envp
 #
-# 0x1077ca posix_spawn(rsp+0x64, "/bin/sh", [rsp+0x38], 0, rsp+0x70, [rsp+0xf0])
-# constraints:
-#   [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv
-#   [[rsp+0xf0]] == NULL || [rsp+0xf0] == NULL || [rsp+0xf0] is a valid envp
-#   [rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0
-#
-# 0x1077d2 posix_spawn(rsp+0x64, "/bin/sh", [rsp+0x38], 0, rsp+0x70, r9)
+# 0x1075e7 posix_spawn(rsp+0x64, "/bin/sh", rdx, 0, rsp+0x70, r9)
 # constraints:
 #   [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv
 #   [r9] == NULL || r9 == NULL || r9 is a valid envp
-#   [rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0
+#   rdx == NULL || (s32)[rdx+0x4] <= 0x0
 #
-# 0x1077d7 posix_spawn(rsp+0x64, "/bin/sh", rdx, 0, rsp+0x70, r9)
-# constraints:
-#   [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv
-#   [r9] == NULL || r9 == NULL || r9 is a valid envp
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
-#
-# 0x1077e1 posix_spawn(rdi, "/bin/sh", rdx, 0, r8, r9)
+# 0x1075f1 posix_spawn(rdi, "/bin/sh", rdx, 0, r8, r9)
 # constraints:
 #   [r8] == NULL || r8 is a valid argv
 #   [r9] == NULL || r9 == NULL || r9 is a valid envp
 #   rdi == NULL || writable: rdi
-#   rdx == NULL || (s32)[rdx+0x4] <= 0
+#   rdx == NULL || (s32)[rdx+0x4] <= 0x0
+#
+# 0x107cea posix_spawn(rsp+0x64, "/bin/sh", [rsp+0x38], 0, rsp+0x70, environ)
+# constraints:
+#   [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv
+#   [rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] <= 0x0
 
 ```
 
@@ -463,22 +490,30 @@ $ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --level 1
 
 ##### i386
 ```bash
-$ one_gadget /lib32/libc.so.6
-# 0xc890b execve("/bin/sh", [ebp-0x2c], esi)
+$ one_gadget spec/data/libc-2.27-63b3d43ad45e1b0f601848c65b067f9e9b40528b.so
+# 0x3cbf7 execve("/bin/sh", esp+0x40, environ)
 # constraints:
-#   address ebp-0x20 is writable
-#   ebx is the GOT address of libc
-#   [[ebp-0x2c]] == NULL || [ebp-0x2c] == NULL || [ebp-0x2c] is a valid argv
-#   [esi] == NULL || esi == NULL || esi is a valid envp
+#   esi is the GOT address of libc
+#   [esp+0x40] == NULL || {[esp+0x40], [esp+0x44], [esp+0x48], [esp+0x4c], ...} is a valid argv
 #
-# 0x1421b3 execl("/bin/sh", eax)
+# 0x6729f execl("/bin/sh", eax)
 # constraints:
-#   ebp is the GOT address of libc
+#   esi is the GOT address of libc
+#   eax == NULL
+#
+# 0x672a0 execl("/bin/sh", [esp])
+# constraints:
+#   esi is the GOT address of libc
+#   [esp] == NULL
+#
+# 0x13573e execl("/bin/sh", eax)
+# constraints:
+#   ebx is the GOT address of libc
 #   eax == NULL
 #
-# 0x1421b4 execl("/bin/sh", [esp])
+# 0x13573f execl("/bin/sh", [esp])
 # constraints:
-#   ebp is the GOT address of libc
+#   ebx is the GOT address of libc
 #   [esp] == NULL
 
 ```
@@ -490,31 +525,60 @@ $ one_gadget spec/data/aarch64-libc-2.27.so
 # 0x3f160 execve("/bin/sh", sp+0x70, environ)
 # constraints:
 #   address x20+0x338 is writable
-#   x3 == NULL
+#   x22 == NULL
+#   x3 == NULL || {x3, "-c", x23, NULL} is a valid argv
 #
-# 0x3f184 execve("/bin/sh", sp+0x70, environ)
+# 0x63e90 execl("/bin/sh", x1)
 # constraints:
-#   addresses x19+0x4, x20+0x338 are writable
-#   [sp+0x70] == NULL
+#   x1 == NULL
 #
-# 0x3f1a8 execve("/bin/sh", x21, environ)
+# 0xa321c execve("/bin/sh", sp+0x40, x2)
 # constraints:
-#   addresses x19+0x4, x20+0x338 are writable
-#   [x21] == NULL || x21 == NULL
+#   [x1] == 0x0
+#   x0 == NULL || {"/bin/sh", x0, NULL} is a valid argv
+#   [x2] == NULL || x2 == NULL || x2 is a valid envp
 #
-# 0x63e90 execl("/bin/sh", x1)
+# 0xa32e8 execve("/bin/sh", x29+0x40, x23)
 # constraints:
-#   x1 == NULL
+#   address x29+0x40 is writable
+#   x0 == NULL || {"/bin/sh", x0, NULL} is a valid argv
+#   [x23] == NULL || x23 == NULL || x23 is a valid envp
 
 ```
 ![aarch64](https://github.com/david942j/one_gadget/blob/master/examples/aarch64.png?raw=true)
 
+##### ARM32
+
+```bash
+$ one_gadget spec/data/arm-libc-2.39.so
+# 0x38f6c posix_spawn(r0, "/bin/sh", r2, r8, [sp], r3)
+# constraints:
+#   [[sp]] == NULL || [sp] is a valid argv
+#   [r3] == NULL || r3 == NULL || r3 is a valid envp
+#   r0 == NULL || writable: r0
+#   r2 == NULL || (s32)[r2+0x4] <= 0x0
+#   r8 == NULL || (u16)[r8] == 0x0
+#
+# 0x88a7c execve("/bin/sh", r4, r5)
+# constraints:
+#   [r4] == NULL || r4 == NULL || r4 is a valid argv
+#   [r5] == NULL || r5 == NULL || r5 is a valid envp
+#
+# 0x9f2be posix_spawn([sp+0x34], "/bin/sh", [sp+0x2c], 0, [sp+0x3c], r3)
+# constraints:
+#   [[sp+0x3c]] == NULL || [sp+0x3c] is a valid argv
+#   [r3] == NULL || r3 == NULL || r3 is a valid envp
+#   [sp+0x34] == NULL || writable: [sp+0x34]
+#   [sp+0x2c] == NULL || (s32)[[sp+0x2c]+0x4] <= 0x0
+
+```
+
 #### Combine with Script
 Pass your exploit script as `one_gadget`'s arguments, it can
 try all gadgets one by one, so you don't need to try every possible gadgets manually.
 
 ```bash
-$ one_gadget ./spec/data/libc-2.19.so -s 'echo "offset ->"'
+$ one_gadget spec/data/libc-2.31-9fdb74e7b217d06c93172a8243f8547f947ee6d1.so -s 'echo "offset ->"'
 ```
 
 ![--script](https://github.com/david942j/one_gadget/blob/master/examples/script.png?raw=true)
@@ -522,16 +586,16 @@ $ one_gadget ./spec/data/libc-2.19.so -s 'echo "offset ->"'
 ### In Ruby Scripts
 ```ruby
 require 'one_gadget'
-OneGadget.gadgets(file: '/lib/x86_64-linux-gnu/libc.so.6')
-#=> [932606, 932609, 932612]
+OneGadget.gadgets(file: 'spec/data/libc-2.31-9fdb74e7b217d06c93172a8243f8547f947ee6d1.so')
+#=> [932657, 932660, 932896, 1080554]
 
 # or in shorter way
-one_gadget('/lib/x86_64-linux-gnu/libc.so.6', level: 1)
-#=> [335355, 335362, 335369, 335376, 335381, 335397, 335402, 335405, 335410, 540981, 540988, 540995, 540998, 541003, 541008, 541020, 541026, 541033, 541040, 932606, 932609, 932612, 933107, 933110, 933218, 933225, 933232, 933287, 933297, 933301, 933309, 1079242, 1079250, 1079255, 1079265]
+one_gadget('spec/data/libc-2.31-9fdb74e7b217d06c93172a8243f8547f947ee6d1.so', level: 1)
+#=> [335352, 335403, 335410, 335417, 335424, 335429, 335445, 335450, 541029, 541036, 541043, 541046, 541051, 541056, 541068, 541074, 541081, 541088, 932657, 932660, 932896, 933158, 933256, 933264, 933266, 933273, 933280, 933335, 933345, 1078759, 1078769, 1080554]
 
 # from build id
 one_gadget('b417c0ba7cc5cf06d1d1bed6652cedb9253c60d0')
-#=> [324286, 324293, 324386, 1090444]
+#=> [324386, 939736, 940131, 1090444]
 
 ```
 
@@ -541,8 +605,8 @@ import subprocess
 def one_gadget(filename):
   return [int(i) for i in subprocess.check_output(['one_gadget', '--raw', filename]).decode().split(' ')]
 
-one_gadget('/lib/x86_64-linux-gnu/libc.so.6')
-#=> [932606, 932609, 932612]
+one_gadget('spec/data/libc-2.31-9fdb74e7b217d06c93172a8243f8547f947ee6d1.so')
+#=> [932657, 932660, 932896, 1080554]
 
 ```