one_gadget 1.10.0 → 2.0.0

data/lib/one_gadget/emulators/register_file.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require 'one_gadget/emulators/lambda'
+
+module OneGadget
+  module Emulators
+    # The register state of one emulated candidate, keyed so that names sharing
+    # storage share a value: what a write through a narrower name leaves behind is
+    # what a read of the full register finds, and the other way round.
+    #
+    # Values are kept under the full register's name, so an operand rendered into a
+    # constraint names the storage the caller has to arrange, whichever name the
+    # instruction used to reach it.
+    # @example (amd64) the first argument, set through its 32-bit name
+    #   file['edi'] = 1
+    #   file['rdi'] #=> 1
+    class RegisterFile < Hash
+      # Build the initial state: one entry per distinct storage, holding the value
+      # the block returns for its full name.
+      # @param [Array<String>] names All the register names the architecture accepts.
+      # @param [Hash{String => String}] narrow_views Narrower name => full register.
+      # @yieldparam [String] name The full register's name.
+      # @return [RegisterFile]
+      def self.build(names, narrow_views)
+        new(narrow_views).tap do |file|
+          names.map { |name| narrow_views.fetch(name, name) }
+               .uniq
+               .each { |name| file[name] = yield(name) }
+        end
+      end
+
+      # @param [Hash{String => String}] narrow_views Narrower name => full register.
+      def initialize(narrow_views = {})
+        super()
+        @narrow_views = narrow_views
+        @entry_halves = {}
+      end
+
+      def [](name)
+        value = super(full(name))
+        narrow?(name) ? narrowed(name, value) : value
+      end
+
+      def []=(name, value)
+        super(full(name), value)
+      end
+
+      def key?(name)
+        super(full(name))
+      end
+      alias has_key? key?
+      alias include? key?
+      alias member? key?
+
+      private
+
+      # The name +name+'s storage is kept under: itself, unless it is a narrower
+      # view of a wider register.
+      # @param [String] name
+      # @return [String]
+      def full(name)
+        @narrow_views.fetch(name, name)
+      end
+
+      # @param [String] name
+      # @return [Boolean] Whether +name+ addresses part of a wider register.
+      def narrow?(name)
+        @narrow_views.key?(name)
+      end
+
+      # The part of +value+ that +name+ addresses. Only one such part can be named
+      # exactly: the low half of a register still holding what the gadget was
+      # entered with, which is what the narrower name means. Anything else is
+      # handed back whole, since no expression names half of it -- an
+      # over-approximation, and one that only ever tightens a constraint or drops
+      # the path it renders.
+      #
+      # The name's own lambda is kept rather than rebuilt, so that repeated reads
+      # of an untouched register return one object: a register's value is compared
+      # by identity to tell a reassignment from the value that was there before
+      # (see {Processor#reg_based_stack}).
+      # @param [String] name A narrower name (see {#narrow?}).
+      # @param [Object] value The value held by the register it names part of.
+      # @return [Object]
+      def narrowed(name, value)
+        return value unless entry_value?(value, full(name))
+
+        @entry_halves[name] ||= Lambda.new(name)
+      end
+
+      # Whether +value+ is still the untouched value +reg+ was entered with.
+      def entry_value?(value, reg)
+        value.is_a?(Lambda) && value.obj == reg && value.deref_count.zero? && value.immi.zero?
+      end
+    end
+  end
+end

data/lib/one_gadget/emulators/safe_calls.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module OneGadget
+  module Emulators
+    # Arch-independent catalog of libc calls the emulator accepts without
+    # executing them (see {Processor#dispatch_safe_call} for how an entry's
+    # per-argument requirements are applied and what each requirement symbol
+    # means). These functions -- syscall wrappers and +posix_spawn+'s setup
+    # helpers -- have identical semantics on every architecture, so their
+    # requirements live here once instead of being copied into each arch's
+    # emulator, keeping the arches from drifting.
+    #
+    # Order matters: the first key that is a substring of the call symbol wins, so
+    # the specific +posix_spawnattr_setsigmask+/+setsigdefault+ keys precede the
+    # generic +posix_spawnattr_+ prefix.
+    module SafeCalls
+      # @return [Hash{String => Hash{Integer => Symbol}}]
+      #   Function name (or name prefix) => argument index => requirement.
+      COMMON = {
+        # sigprocmask/__sigaction dereference a pointer arg unless it is NULL, which
+        # glibc guards with an explicit NULL check (and still reaches the call on the
+        # NULL path): sigprocmask's +set+ and __sigaction's +act+ (both arg 1).
+        # __sigaction also writes back through +oldact+ (arg 2), so oldact must be NULL.
+        'sigprocmask' => { 1 => :nullable_deref },
+        '__sigaction' => { 1 => :nullable_deref, 2 => :null },
+        # Record the descriptor __close closes: which one it is decides whether the
+        # spawned shell keeps its I/O (see {Processor#note_closed_fd}).
+        '__close' => { 0 => :closed_fd },
+        # unsetenv reads its name (arg 0); +:global_var?+ may over-constrain it
+        # (readable would suffice), but no current fixture reaches unsetenv near an
+        # exec to verify -- left as-is.
+        'unsetenv' => { 0 => :global_var? },
+        # setsigmask/setsigdefault copy *set into the attr unconditionally, so the
+        # source (arg 1) must be readable and the attr they write (arg 0) writable.
+        'posix_spawnattr_setsigmask' => { 0 => :writable, 1 => :deref },
+        'posix_spawnattr_setsigdefault' => { 0 => :writable, 1 => :deref },
+        # every other attr setup helper writes its attr object (arg 0).
+        'posix_spawnattr_' => { 0 => :writable }
+        # posix_spawn_file_actions_* helpers are deliberately absent, so a candidate
+        # that calls one is aborted (see {Processor#dispatch_safe_call}) rather than
+        # walked through. Accepting them would need a model out of reach today:
+        #   * the helper returns 0 only when its fd argument is a valid fd
+        #     (0 <= fd < INT_MAX), and the caller branches on that return -- a nonzero
+        #     result skips the following +posix_spawn+ -- so treating the call as
+        #     always succeeding emits a gadget whose reachability doesn't actually hold;
+        #   * appending the action grows +__actions+ via +realloc+, which can fail
+        #     (ENOMEM) or fault on a bogus object -- not guaranteeable from a symbolic
+        #     writable pointer;
+        #   * +posix_spawn_file_actions_t+ is a glibc-internal, version-dependent
+        #     layout, so modeling its fields soundly across libc versions is fragile;
+        #   * and a successful call injects a close/open/dup2 into the spawned child
+        #     whose harmlessness depends on the fd, which isn't expressible.
+      }.freeze
+    end
+  end
+end

data/lib/one_gadget/emulators/x86.rb

@@ -9,20 +9,11 @@ module OneGadget
   module Emulators
     # Super class for amd64 and i386 processor.
     class X86 < Processor
-      attr_reader :bp # @return [String] Stack base register.
-      attr_reader :bp_based_stack # @return [Hash{Integer => OneGadget::Emulators::Lambda}] Stack content based on bp.
-
       # Constructor for a x86 processor.
       def initialize(registers, sp, bp, pc)
         super(registers, sp)
-        @bp = bp
         @pc = pc
-        @bp_based_stack = Hash.new do |h, k|
-          h[k] = OneGadget::Emulators::Lambda.new(bp).tap do |lmda|
-            lmda.immi = k
-            lmda.deref!
-          end
-        end
+        setup_frame_pointer(bp)
       end
 
       # Process one command.
@@ -32,26 +23,62 @@ module OneGadget
       # @return [Boolean]
       #   If successfully processed.
       def process!(cmd)
-        inst, args = parse(cmd)
-        # return registers[pc] = args[0] if inst.inst == 'call'
-        return true if inst.inst == 'jmp' # believe the fetcher has handled jmp.
+        cmd = concretize_rip(cmd)
+        resolve_pending_branch(cmd)
+        mnem = mnemonic(cmd)
+        return handle_compare(COMPARES[mnem], cmd) if COMPARES.key?(mnem)
+        return handle_branch(mnem, cmd) != :fail if branch_mnem?(mnem)
 
+        inst, args = parse(cmd)
         sym = :"inst_#{inst.inst}"
         __send__(sym, *args) != :fail
       end
 
+      # x86 conditional-jump mnemonics mapped to shared {Conditional::RELATION}
+      # predicates (x86's adapter table, as {AArch64::COND} is for arm/aarch64).
+      JCC = {
+        'je' => :eq, 'jz' => :eq, 'jne' => :ne, 'jnz' => :ne,
+        'jb' => :ult, 'jc' => :ult, 'jnae' => :ult, 'jae' => :uge, 'jnb' => :uge, 'jnc' => :uge,
+        'ja' => :ugt, 'jnbe' => :ugt, 'jbe' => :ule, 'jna' => :ule,
+        'jl' => :slt, 'jnge' => :slt, 'jge' => :sge, 'jnl' => :sge,
+        'jg' => :sgt, 'jnle' => :sgt, 'jle' => :sle, 'jng' => :sle,
+        'js' => :slt, 'jns' => :sge
+      }.freeze
+
+      # x86 flag-setting compare mnemonics mapped to the ALU op whose result their
+      # flags reflect (see {Conditional::COMPARE_OPS}). +test+ is a bitwise AND, +cmp+
+      # a subtraction.
+      COMPARES = { 'cmp' => :sub, 'test' => :and }.freeze
+
+      # A segment-prefixed operand reads thread-local storage, which isn't modelled
+      # (nor is its counterpart on the other arches -- aarch64's +mrs tpidr_el0+
+      # and arm's +mrc p15+ are unsupported instructions, so those paths already
+      # abort). Every gadget observed behind one tests +errno == ENOEXEC+ on
+      # glibc's +execvpe+ path -- a value the caller would have to have arranged
+      # beforehand, since the gadget is entered after the +execve+ that would set
+      # it -- so modelling this only produces gadgets that all but never apply.
+      # Worth revisiting if a libc is found reaching a terminal call under a
+      # condition that commonly holds, e.g. +errno != <some error>+.
+      # @example +cmp DWORD PTR fs:[r14], 0x8+ -- errno == ENOEXEC
+      SEGMENT_OPERAND = /\b(?:fs|gs|ds|es|ss|cs):/
+
       # Supported instruction set.
       # @return [Array<Instruction>] The supported instructions.
       def instructions
         [
           Instruction.new('add', 2),
+          Instruction.new('and', 2),
           Instruction.new('call', 1),
+          Instruction.new('endbr32', -1),
+          Instruction.new('endbr64', -1),
           Instruction.new('jmp', 1),
           Instruction.new('lea', 2),
           Instruction.new('mov', 2),
+          Instruction.new('movsxd', 2),
           Instruction.new('nop', -1),
           Instruction.new('push', 1),
           Instruction.new('sub', 2),
+          Instruction.new('xchg', 2),
           Instruction.new('xor', 2),
           Instruction.new('movq', 2),
           Instruction.new('movaps', 2),
@@ -60,53 +87,94 @@ module OneGadget
         ]
       end
 
-      # @param [String | Lambda] obj
-      #  A lambda object or its string.
-      # @return [Hash{Integer => Lambda}, nil]
-      #  The corresponding stack (based on esp/rsp or ebp/rbp) that +obj+ used,
-      #  or nil if +obj+ doesn't use the stack.
-      # @example
-      #   get_corresponding_stack('rsp+0x10')
-      #   #=> sp_based_stack
-      #   get_corresponding_stack('rbp-0x10')
-      #   #=> bp_based_stack
-      #   get_corresponding_stack('[rbp-0x10]')
-      #   #=> bp_based_stack
-      #   get_corresponding_stack('rax')
-      #   #=> nil
-      def get_corresponding_stack(obj)
-        if obj.to_s.include?(sp)
-          sp_based_stack
-        elsif obj.to_s.include?(bp)
-          bp_based_stack
+      private
+
+      # Whether a whole register's worth of value is what this operand names.
+      def swappable?(operand)
+        register?(operand) && !OneGadget::ABI::NARROW_VIEWS.fetch(arch_name, {}).key?(operand)
+      end
+
+      def branch_mnem?(mnem)
+        mnem == 'jmp' || JCC.key?(mnem) || %w[jcxz jecxz jrcxz].include?(mnem)
+      end
+
+      # Operands of +cmd+ (mnemonic dropped), size hints removed, each stripped of
+      # a trailing +<symbol>+.
+      def operands(cmd)
+        raise Error::UnsupportedInstructionArgumentError, cmd if SEGMENT_OPERAND.match?(cmd)
+
+        cmd.sub(/\A[0-9a-f]+:\s*\S+\s*/, '').split(',').map do |o|
+          o.gsub(/\b(XMMWORD|QWORD|DWORD|WORD|BYTE|PTR)\b/, '').strip.sub(/\s*<.*>\z/, '')
         end
       end
 
-      private
+      # Arch-specific hook to rewrite a line's operands before it is processed. A
+      # no-op here; amd64 overrides it to resolve rip-relative operands (i386 has
+      # no rip-relative addressing, so it keeps the no-op). See {Amd64#concretize_rip}.
+      def concretize_rip(cmd) = cmd
+
+      # The (direct) target address of a jump line.
+      def jump_target(cmd)
+        cmd[/\A[0-9a-f]+:\s*\S+\s+([0-9a-f]+)/, 1].to_i(16)
+      end
+
+      def handle_branch(mnem, cmd)
+        return true if mnem == 'jmp' # unconditional: control handled by the stitched path
+        return branch_on_zero(jump_target(cmd), cx_reg(mnem), negate: false) if mnem.end_with?('cxz')
+
+        branch_on_compare(JCC[mnem], jump_target(cmd))
+      end
+
+      def cx_reg(mnem)
+        { 'jcxz' => 'cx', 'jecxz' => 'ecx', 'jrcxz' => 'rcx' }[mnem]
+      end
 
       def inst_mov(dst, src)
         src = arg_to_lambda(src)
         if register?(dst)
-          registers[dst] = src
+          registers[dst] = read_value(src)
           return
         end
         dst = arg_to_lambda(dst)
-        add_writable(dst.to_s)
-        # TODO: Is it possible that only considering sp and bp is not enough?
-        # If it is, we need to record every memory access
-        stack = get_corresponding_stack(dst)
-        return if stack.nil? || dst.deref_count != 1
+        # dup: add_writable ref!s its argument, and dst is reused below.
+        add_writable(dst.dup.ref!)
+        # resolve_address takes the address the store writes to, i.e. the operand
+        # with the store's own dereference peeled off.
+        stack, offset = resolve_address(dst.ref!)
+        stack&.store(offset, src)
+      end
+
+      # +movsxd dst, src+: +src+'s low 32 bits, sign-extended into the 64-bit +dst+.
+      # A destination that isn't a register would be a store the emulator doesn't
+      # model, so the candidate is abandoned rather than tracked wrongly.
+      def inst_movsxd(dst, src)
+        check_register!(dst)
 
-        dst.ref!
-        stack[dst.evaluate(eval_dict)] = src
+        registers[dst] = sign_extend32(read_value(arg_to_lambda(src)))
+      end
+
+      # What a 32-bit +val+ sign-extends to. Only a concrete value can be extended;
+      # a symbolic one is taken whole, since no expression names its low half --
+      # the same over-approximation a narrow register read makes (see
+      # {RegisterFile#narrowed}).
+      # @example
+      #   sign_extend32(0x1)        #=> 0x1
+      #   sign_extend32(0xffffffff) #=> -0x1
+      def sign_extend32(val)
+        return val unless val.is_a?(Integer)
+
+        low = val & 0xffffffff
+        low < 0x80000000 ? low : low - 0x100000000
       end
 
       # This instruction moves 128bits.
       def inst_movaps(dst, src)
         # XXX: here we only support `movaps [sp+*], xmm*`
         src, dst = check_xmm_sp(src, dst) { raise_unsupported('movaps', dst, src) }
+        raise_unsupported('movaps', dst, src) unless src.is_a?(Array)
+
         off = dst.evaluate(eval_dict)
-        @constraints << [:raw, "#{sp} & 0xf == #{0x10 - off & 0xf}"]
+        @constraints << [:raw, "#{sp} & 0xf == #{OneGadget::Helper.hex(0x10 - off & 0xf)}"]
         (128 / self.class.bits).times do |i|
           sp_based_stack[off + i * size_t] = src[i]
         end
@@ -120,10 +188,14 @@ module OneGadget
         if self.class.bits == 64 && xmm_reg?(dst) && src.start_with?('r') && register?(src)
           dst = arg_to_lambda(dst)
           src = arg_to_lambda(src)
+          raise_unsupported('movq', dst, src) unless dst.is_a?(Array)
+
           dst[0] = src
           return
         end
         dst, src = check_xmm_sp(dst, src) { raise_unsupported('movq', dst, src) }
+        raise_unsupported('movq', dst, src) unless dst.is_a?(Array)
+
         off = src.evaluate(eval_dict)
         (64 / self.class.bits).times do |i|
           dst[i] = sp_based_stack[off + i * size_t]
@@ -134,6 +206,8 @@ module OneGadget
       def inst_movhps(dst, src)
         # XXX: here we only support `movhps xmm*, [sp+*]`
         dst, src = check_xmm_sp(dst, src) { raise_unsupported('movhps', dst, src) }
+        raise_unsupported('movhps', dst, src) unless dst.is_a?(Array)
+
         off = src.evaluate(eval_dict)
         (64 / self.class.bits).times do |i|
           dst[i + 64 / self.class.bits] = sp_based_stack[off + i * size_t]
@@ -162,6 +236,8 @@ module OneGadget
 
         dst = arg_to_lambda(dst)
         src = arg_to_lambda(src)
+        raise_unsupported('punpcklqdq', dst, src) unless dst.is_a?(Array) && src.is_a?(Array)
+
         (64 / self.class.bits).times do |i|
           dst[i + 64 / self.class.bits] = src[i]
         end
@@ -188,18 +264,39 @@ module OneGadget
         # only supports dst == src
         raise Error::UnsupportedInstructionArgumentError, 'xor operator only supports dst = src' unless dst == src
 
-        dst[0] = 'r' if self.class.bits == 64 && dst.start_with?('e')
         registers[dst] = 0
       end
 
       def inst_add(dst, src)
         check_register!(dst)
 
-        src = arg_to_lambda(src)
-        registers[dst] += src
+        registers[dst] += read_value(arg_to_lambda(src))
+      end
+
+      # +and dst, src+ both writes +dst+ and sets the flags a following branch
+      # reads, so it does both: model the result, then record the compare the
+      # +test+ of the same operands would have (see {Conditional::COMPARE_OPS}).
+      # Modelling only the flags would leave +dst+ holding a value the gadget has
+      # already replaced.
+      def inst_and(dst, src)
+        check_register!(dst)
+
+        src = read_value(arg_to_lambda(src))
+        result = mask_result(registers[dst], src)
+        record_compare(:and, value_str(registers[dst]), value_str(src))
+        registers[dst] = result
+      end
+
+      # +lhs & rhs+, or an abort when the result is nothing this emulator can name.
+      # @param [Lambda, Integer] lhs The value being masked.
+      # @param [Lambda, Integer] rhs The mask.
+      # @return [Lambda, Integer] The masked value.
+      def mask_result(lhs, rhs)
+        operation_result(:&, lhs, rhs) || raise_unsupported('and', lhs, rhs)
       end
 
       def inst_sub(dst, src)
+        check_register!(dst)
         src = arg_to_lambda(src)
         raise Error::UnsupportedInstructionArgumentError, "Unhandled -= of type #{src.class}" unless src.is_a?(Integer)
 
@@ -209,33 +306,32 @@ module OneGadget
       # yap, nop
       def inst_nop(*); end
 
-      # Handle some valid calls.
-      # For example, +sigprocmask+ will always be a valid call
-      # because it just invokes syscall.
-      def inst_call(addr)
-        # This is the last call
-        return registers[pc] = addr if %w[execve execl posix_spawn].any? { |n| addr.include?(n) }
+      # A marker for the branch predictor: it says a jump may land here and leaves
+      # every value alone.
+      def inst_endbr64(*); end
+      alias inst_endbr32 inst_endbr64
 
-        # TODO: handle some registers would be fucked after call
-        checker = {
-          'sigprocmask' => {},
-          '__close' => {},
-          'unsetenv' => { 0 => :global_var? },
-          '__sigaction' => { 1 => :global_var?, 2 => :zero? }
-        }
-        func = checker.keys.find { |n| addr.include?(n) }
-        return if func && checker[func].all? { |idx, sym| check_argument(idx, sym) }
-
-        # unhandled case or checker's condition fails
-        :fail
+      # Swap what two registers hold. Two forms are not that, and stay refused: a
+      # memory operand is an exchange with memory (and an atomic one), and a
+      # narrower view names part of a register, which swapping whole values cannot
+      # express. Naming one place twice is nothing at all, whatever it names --
+      # that is the multi-byte nop a compiler pads with.
+      # @example
+      #   xchg ebx,edi  -- a swap
+      #   xchg ax,ax    -- padding
+      def inst_xchg(dst, src)
+        return if dst == src
+        raise Error::UnsupportedInstructionArgumentError, "xchg #{dst},#{src}" unless
+          swappable?(dst) && swappable?(src)
+
+        registers[dst], registers[src] = registers[src], registers[dst]
       end
 
-      def add_writable(dst)
-        lmda = arg_to_lambda(dst).ref!
-        # pc-relative addresses should be writable
-        return if lmda.obj == pc
+      # TODO: handle some registers would be fucked after call
+      def inst_call(addr)
+        return reach_terminal_call(addr) if terminal_call?(addr)
 
-        @constraints << [:writable, lmda]
+        dispatch_safe_call(addr)
       end
 
       def to_lambda(reg)
@@ -246,10 +342,6 @@ module OneGadget
           OneGadget::Emulators::Lambda.new(i.zero? ? "#{cast}#{reg}" : "#{cast}(#{reg} >> #{self.class.bits * i})")
         end
       end
-
-      def eval_dict
-        { sp => 0, bp => 0 }
-      end
     end
   end
 end

data/lib/one_gadget/error.rb

@@ -30,5 +30,17 @@ module OneGadget
     # Argument error of ruby methods.
     class ArgumentError < Error
     end
+
+    # Raises when the branches taken so far cannot all hold at once, i.e. the
+    # walked path can never execute.
+    class InfeasiblePathError < Error
+    end
+
+    # Raises when a register is read whose value a call left unspecified, so
+    # nothing can be said about it (see
+    # {OneGadget::Emulators::Processor#clobber_caller_saved}). The instruction
+    # itself is understood; its operand simply has no value to reason about.
+    class ClobberedRegisterError < Error
+    end
   end
 end

data/lib/one_gadget/fetchers/aarch64.rb

@@ -4,18 +4,43 @@ require 'one_gadget/emulators/aarch64'
 require 'one_gadget/fetchers/base'
 
 module OneGadget
-  module Fetcher
+  module Fetchers
     # Define common methods for gadget fetchers.
     class AArch64 < Base
+      # aarch64 condition codes (used to recognise +b.<cond>+ branches).
+      CONDS = %w[eq ne cs hs cc lo mi pl vs vc hi ls ge lt gt le].freeze
+
       private
 
+      # +BL imm26+ is AArch64's only direct call, one word wide and word-aligned,
+      # so the whole scan is a masked compare per word.
+      def scan_calls(base, data, targets)
+        sites = []
+        data.unpack('V*').each_with_index do |word, i|
+          next unless (word & 0xfc000000) == 0x94000000
+
+          imm = word & 0x03ffffff
+          imm -= 1 << 26 if imm.anybits?(1 << 25)
+          addr = base + (i * 4)
+          sites << addr if targets.key?(addr + (imm * 4))
+        end
+        sites
+      end
+
       def emulator
         OneGadget::Emulators::AArch64.new
       end
 
-      # If str contains a branch instruction.
-      def branch?(str)
-        %w[b b.hi b.gt b.eq b.le b.ls b.lt b.ne b.cs].any? { |f| str.include?(" #{f} ") }
+      def branch_lead_chars
+        'bct'
+      end
+
+      def branch_kind(line)
+        m = mnemonic(line)
+        return :conditional if %w[cbz cbnz tbz tbnz].include?(m) || (m.start_with?('b.') && CONDS.include?(m[2..]))
+        return :unconditional if %w[b b.al].include?(m)
+
+        :terminator if %w[ret br braa brab braaz brabz].include?(m)
       end
 
       def call_str
@@ -30,13 +55,23 @@ module OneGadget
         str.include?('$base') && str.include?(bin_sh_offset.to_s(16))
       end
 
+      # Offset of the standalone "sh" string (\0-preceded and \0-terminated) that
+      # glibc passes as argv[0] in execl("/bin/sh", "sh", ...). Its distance from
+      # "/bin/sh" is build-specific, so locate it directly instead of guessing.
+      # +nil+ when the libc has no such string.
+      def sh_offset
+        return @sh_offset if defined?(@sh_offset)
+
+        idx = File.binread(file).index("\x00sh\x00")
+        @sh_offset = idx && idx + 1
+      end
+
       def str_sh?(str)
-        # XXX: hardcode -0x10 is bad
-        str.include?('$base') && str.include?((bin_sh_offset - 0x10).to_s(16))
+        !sh_offset.nil? && str.include?('$base') && str.include?(sh_offset.to_s(16))
       end
 
       def global_var?(str)
-        str.include?('$base')
+        base_relative?(str, '$base')
       end
     end
   end

data/lib/one_gadget/fetchers/amd64.rb

@@ -4,52 +4,25 @@ require 'one_gadget/emulators/amd64'
 require 'one_gadget/fetchers/x86'
 
 module OneGadget
-  module Fetcher
+  module Fetchers
     # Fetcher for amd64.
-    class Amd64 < OneGadget::Fetcher::X86
+    class Amd64 < OneGadget::Fetchers::X86
       private
 
       def emulator
         OneGadget::Emulators::Amd64.new
       end
 
+      # The branch-aware walker (see {Base#branch_aware_candidates}) already
+      # stitches +jmp+ targets, so only the filter remains.
       def candidates
-        # one basic block case
-        cands = super do |candidate|
+        super do |candidate|
           next true if candidate.include?('posix_spawn@')
           next false unless candidate.include?(bin_sh_hex) # works in x86-64
           next false unless candidate.lines.last.include?('execve') # only care execve
 
           true
         end
-        cands + jmp_case_candidates
-      end
-
-      # find gadgets in form:
-      #   lea rdi, '/bin/sh'
-      #   ...
-      #   jmp xxx
-      # xxx:
-      #   ...
-      #   call execve
-      def jmp_case_candidates
-        `#{@objdump.command}|grep -E '# #{bin_sh_hex}' -A 8`.split('--').map do |cand|
-          cand = cand.lines.map(&:strip).reject(&:empty?)
-          jmp_at = cand.index { |c| c.include?('jmp') }
-          next nil if jmp_at.nil?
-
-          cand = cand[0..jmp_at]
-          next if cand.any? { |c| c.include?(call_str) }
-
-          jmp_addr = cand.last.scan(/jmp\s+([\da-f]+)\s/)[0][0].to_i(16)
-          dump = `#{@objdump.command(start: jmp_addr, stop: jmp_addr + 100)}|grep -E '[0-9a-f]+:'`
-          remain = dump.lines.map(&:strip).reject(&:empty?)
-          call_execve = remain.index { |r| r.match(/call.*<execve[^+]*>/) }
-          next if call_execve.nil?
-
-          remain = remain[0..call_execve]
-          [cand + remain].join("\n")
-        end.compact
       end
 
       def bin_sh_hex
@@ -57,11 +30,11 @@ module OneGadget
       end
 
       def str_bin_sh?(str)
-        str.include?('rip+0x') # && str.include?(bin_sh_hex)
+        str.include?('$base') && str.include?(bin_sh_hex)
       end
 
       def global_var?(str)
-        str.include?('rip')
+        base_relative?(str, '$base')
       end
     end
   end