one_gadget 1.4.1 → 1.5.0

data/lib/one_gadget/builds/libc-2.19-9e817f4c472417e94d161b392e13d6aeb76f0b5a.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-i686-2.19-17/lib/i386-linux-gnu/i686/cmov/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian GLIBC 2.19-17) stable release version 2.19, by Roland McGrath et al.
@@ -21,6 +23,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 254487,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x34] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x34, environ)")
+OneGadget::Gadget.add(build_id, 254523,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 254527,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 412619,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-a13df1fb206f167af0eef4d438f3949d80f8bce3.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-amd64-2.19-13/lib64/libc-2.19.so
+# 
 # Advanced Micro Devices X86-64
 # 
 # GNU C Library (Debian GLIBC 2.19-13) stable release version 2.19, by Roland McGrath et al.
@@ -18,6 +20,9 @@ require 'one_gadget/gadget'
 # <http://www.debian.org/Bugs/>.
 
 build_id = File.basename(__FILE__, '.rb').split('-').last
+OneGadget::Gadget.add(build_id, 267088,
+                      constraints: ["rax == NULL"],
+                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
 OneGadget::Gadget.add(build_id, 267172,
                       constraints: ["[rsp+0x30] == NULL"],
                       effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
@@ -30,6 +35,9 @@ OneGadget::Gadget.add(build_id, 754348,
 OneGadget::Gadget.add(build_id, 869895,
                       constraints: ["[rsp+0x70] == NULL"],
                       effect: "execve(\"/bin/sh\", rsp+0x70, environ)")
+OneGadget::Gadget.add(build_id, 869907,
+                      constraints: ["[rsi] == NULL || rsi == NULL", "[[rax]] == NULL || [rax] == NULL"],
+                      effect: "execve(\"/bin/sh\", rsi, [rax])")
 OneGadget::Gadget.add(build_id, 885008,
                       constraints: ["[r9] == NULL || r9 == NULL", "[rdx] == NULL || rdx == NULL"],
                       effect: "execve(\"/bin/sh\", r9, rdx)")

data/lib/one_gadget/builds/libc-2.19-a1818c2dd8e7c4a3d4f61270b4b29330d6b51391.rb

@@ -0,0 +1,40 @@
+require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc0.1-2.19-18+deb8u10/lib/i386-kfreebsd-gnu/libc-2.19.so
+# 
+# Intel 80386
+# 
+# GNU C Library (Debian GLIBC 2.19-18+deb8u10) stable release version 2.19, by Roland McGrath et al.
+# Copyright (C) 2014 Free Software Foundation, Inc.
+# This is free software; see the source for copying conditions.
+# There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+# Compiled by GNU CC version 4.8.4.
+# Available extensions:
+# 	crypt add-on version 2.1 by Michael Glad and others
+# 	Native POSIX Threads Library by Ulrich Drepper et al
+# 	GNU Libidn by Simon Josefsson
+# 	BIND-8.2.3-T5B
+# libc ABIs: UNIQUE
+# For bug reporting instructions, please see:
+# <http://www.debian.org/Bugs/>.
+
+build_id = File.basename(__FILE__, '.rb').split('-').last
+OneGadget::Gadget.add(build_id, 248071,
+                      constraints: ["ebx is the GOT address of libc", "[esp+0x38] == NULL"],
+                      effect: "execve(\"/bin/sh\", esp+0x38, environ)")
+OneGadget::Gadget.add(build_id, 248107,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 248111,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
+OneGadget::Gadget.add(build_id, 406580,
+                      constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
+                      effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")
+OneGadget::Gadget.add(build_id, 406586,
+                      constraints: ["ebx is the GOT address of libc", "eax == NULL"],
+                      effect: "execl(\"/bin/sh\", eax)")
+OneGadget::Gadget.add(build_id, 406590,
+                      constraints: ["ebx is the GOT address of libc", "[esp+0x4] == NULL"],
+                      effect: "execl(\"/bin/sh\", [esp+0x4])")
+

data/lib/one_gadget/builds/libc-2.19-a2d884479c5c8f73fbb82e6fefa5083623826cc1.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc0.1-2.19-18+deb8u6~kbsd8u1/lib/i386-kfreebsd-gnu/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian GLIBC 2.19-18+deb8u6~kbsd8u1) stable release version 2.19, by Roland McGrath et al.
@@ -20,6 +22,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 248071,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x38] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x38, environ)")
+OneGadget::Gadget.add(build_id, 248107,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 248111,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 406580,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-a3386004b2a158b95ba4c26c01e421e6c2191a47.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc0.1-2.19-11/lib/i386-kfreebsd-gnu/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian GLIBC 2.19-11) stable release version 2.19, by Roland McGrath et al.
@@ -20,6 +22,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 248151,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x38] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x38, environ)")
+OneGadget::Gadget.add(build_id, 248187,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 248191,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 408708,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-a3c88cff23421ec2e3c97860bdf28868592ed14c.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/lib32-glibc-2.19-4-x86_64.pkg.tar/usr/lib32/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (GNU libc) stable release version 2.19, by Roland McGrath et al.
@@ -18,9 +20,24 @@ require 'one_gadget/gadget'
 # <https://bugs.archlinux.org/>.
 
 build_id = File.basename(__FILE__, '.rb').split('-').last
+OneGadget::Gadget.add(build_id, 242675,
+                      constraints: ["ebx is the GOT address of libc", "[esp+0x28] == NULL"],
+                      effect: "execve(\"/bin/sh\", esp+0x28, environ)")
+OneGadget::Gadget.add(build_id, 242677,
+                      constraints: ["ebx is the GOT address of libc", "[esp+0x2c] == NULL"],
+                      effect: "execve(\"/bin/sh\", esp+0x2c, environ)")
+OneGadget::Gadget.add(build_id, 242681,
+                      constraints: ["ebx is the GOT address of libc", "[esp+0x30] == NULL"],
+                      effect: "execve(\"/bin/sh\", esp+0x30, environ)")
 OneGadget::Gadget.add(build_id, 242688,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x34] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x34, environ)")
+OneGadget::Gadget.add(build_id, 242723,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp]] == NULL || [esp] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp])")
+OneGadget::Gadget.add(build_id, 242724,
+                      constraints: ["ebx is the GOT address of libc", "[[esp]] == NULL || [esp] == NULL", "[[esp+0x4]] == NULL || [esp+0x4] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp], [esp+0x4])")
 OneGadget::Gadget.add(build_id, 412260,
                       constraints: ["ebx is the GOT address of libc", "eax == NULL"],
                       effect: "execl(\"/bin/sh\", eax)")

data/lib/one_gadget/builds/libc-2.19-a3ebc8ad2873288cbd2a510de65161c697310e5c.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc0.1-i686-2.19-9/lib/i386-kfreebsd-gnu/i686/cmov/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian GLIBC 2.19-9) stable release version 2.19, by Roland McGrath et al.
@@ -20,6 +22,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 249559,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x38] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x38, environ)")
+OneGadget::Gadget.add(build_id, 249595,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 249599,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 409508,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-a4b13a91fc5d961be3e1a68a30938ba840ae4290.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/lib32-glibc-2.19-1-x86_64.pkg.tar/usr/lib32/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (GNU libc) stable release version 2.19, by Roland McGrath et al.
@@ -21,6 +23,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 256283,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x34] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x34, environ)")
+OneGadget::Gadget.add(build_id, 256319,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 256323,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 420083,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-a6222959a65e5367ec3f2b54d7f114f6a2c8ce28.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6_2.19-10ubuntu2.3_i386/lib/i386-linux-gnu/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Ubuntu GLIBC 2.19-10ubuntu2.3) stable release version 2.19, by Roland McGrath et al.
@@ -21,6 +23,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 255651,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x34] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x34, environ)")
+OneGadget::Gadget.add(build_id, 255687,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 255691,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 415083,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-a62a3aed804ccd4faac1ae52ee39165dd1cf4ebe.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc0.3-i686-2.19-14/lib/i386-gnu/i686/cmov/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian GLIBC 2.19-14) stable release version 2.19, by Roland McGrath et al.
@@ -19,6 +21,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 454092,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x30] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x30, environ)")
+OneGadget::Gadget.add(build_id, 454118,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 454122,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 609335,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-a71e7ba2ffe12012ab7e5c0ff7d83d6f627a7548.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc0.3-2.19-14~0/lib/i386-gnu/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian GLIBC 2.19-14~0) stable release version 2.19, by Roland McGrath et al.
@@ -19,6 +21,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 452924,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x30] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x30, environ)")
+OneGadget::Gadget.add(build_id, 452950,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 452954,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 609399,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-a7204938a680127c01c9799462c3b33035f06358.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc0.1-2.19-22/lib/i386-kfreebsd-gnu/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian GLIBC 2.19-22) stable release version 2.19, by Roland McGrath et al.
@@ -20,6 +22,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 248183,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x38] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x38, environ)")
+OneGadget::Gadget.add(build_id, 248219,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 248223,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 406676,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-a77581d3046ec7a2176ba4bebc222562668d9fd6.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc0.1-i686-2.19-18+deb8u3/lib/i386-kfreebsd-gnu/i686/cmov/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian GLIBC 2.19-18+deb8u3) stable release version 2.19, by Roland McGrath et al.
@@ -20,6 +22,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 248423,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x38] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x38, environ)")
+OneGadget::Gadget.add(build_id, 248459,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 248463,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 406212,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-a77d09f3b8cbad4c430378157308f6cb71549a5a.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-i386-2.19-18+deb8u3/lib32/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian GLIBC 2.19-18+deb8u3) stable release version 2.19, by Roland McGrath et al.
@@ -21,6 +23,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 254615,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x34] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x34, environ)")
+OneGadget::Gadget.add(build_id, 254651,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 254655,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 412779,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-a7e2264ecf52a64ea3ab55163132240c3142eafd.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-i686-2.19-18+deb8u1/lib/i386-linux-gnu/i686/cmov/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian GLIBC 2.19-18+deb8u1) stable release version 2.19, by Roland McGrath et al.
@@ -21,6 +23,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 254487,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x34] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x34, environ)")
+OneGadget::Gadget.add(build_id, 254523,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 254527,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 412619,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-a9f67b66e93e0abd79f1d8028188377397e4536b.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-i386-2.19-2/lib32/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian EGLIBC 2.19-2) stable release version 2.19, by Roland McGrath et al.
@@ -21,6 +23,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 261655,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x34] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x34, environ)")
+OneGadget::Gadget.add(build_id, 261691,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 261695,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 415019,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-ab474a836c41aed0f0bad2ddc66388253bfa75af.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc0.3-2.19-7/lib/i386-gnu/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian GLIBC 2.19-7) stable release version 2.19, by Roland McGrath et al.
@@ -19,6 +21,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 453804,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x30] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x30, environ)")
+OneGadget::Gadget.add(build_id, 453830,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 453834,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 610359,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-ad03e0bcbda2213489f10a6bf63a7f5fe3dd6558.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-amd64-2.19-5/lib64/libc-2.19.so
+# 
 # Advanced Micro Devices X86-64
 # 
 # GNU C Library (Debian GLIBC 2.19-5) stable release version 2.19, by Roland McGrath et al.
@@ -18,6 +20,9 @@ require 'one_gadget/gadget'
 # <http://www.debian.org/Bugs/>.
 
 build_id = File.basename(__FILE__, '.rb').split('-').last
+OneGadget::Gadget.add(build_id, 267904,
+                      constraints: ["rax == NULL"],
+                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
 OneGadget::Gadget.add(build_id, 267988,
                       constraints: ["[rsp+0x30] == NULL"],
                       effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
@@ -30,6 +35,9 @@ OneGadget::Gadget.add(build_id, 755228,
 OneGadget::Gadget.add(build_id, 870775,
                       constraints: ["[rsp+0x70] == NULL"],
                       effect: "execve(\"/bin/sh\", rsp+0x70, environ)")
+OneGadget::Gadget.add(build_id, 870787,
+                      constraints: ["[rsi] == NULL || rsi == NULL", "[[rax]] == NULL || [rax] == NULL"],
+                      effect: "execve(\"/bin/sh\", rsi, [rax])")
 OneGadget::Gadget.add(build_id, 885888,
                       constraints: ["[r9] == NULL || r9 == NULL", "[rdx] == NULL || rdx == NULL"],
                       effect: "execve(\"/bin/sh\", r9, rdx)")

data/lib/one_gadget/builds/libc-2.19-ad91c7db0fad11b03e3ce92eda28f673cb36db5d.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc6-i386-2.19-7/lib32/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian GLIBC 2.19-7) stable release version 2.19, by Roland McGrath et al.
@@ -21,6 +23,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 255239,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x34] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x34, environ)")
+OneGadget::Gadget.add(build_id, 255275,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 255279,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 415467,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")

data/lib/one_gadget/builds/libc-2.19-adf7d21d8b442e6b601ad3dcc180608193d2d041.rb

@@ -1,4 +1,6 @@
 require 'one_gadget/gadget'
+# https://gitlab.com/libcdb/libcdb/blob/master/libc/libc0.3-i686-2.19-10/lib/i386-gnu/i686/cmov/libc-2.19.so
+# 
 # Intel 80386
 # 
 # GNU C Library (Debian GLIBC 2.19-10) stable release version 2.19, by Roland McGrath et al.
@@ -19,6 +21,12 @@ build_id = File.basename(__FILE__, '.rb').split('-').last
 OneGadget::Gadget.add(build_id, 453900,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x30] == NULL"],
                       effect: "execve(\"/bin/sh\", esp+0x30, environ)")
+OneGadget::Gadget.add(build_id, 453926,
+                      constraints: ["ebx is the GOT address of libc", "[eax] == NULL || eax == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", eax, [esp+0x8])")
+OneGadget::Gadget.add(build_id, 453930,
+                      constraints: ["ebx is the GOT address of libc", "[[esp+0x4]] == NULL || [esp+0x4] == NULL", "[[esp+0x8]] == NULL || [esp+0x8] == NULL"],
+                      effect: "execve(\"/bin/sh\", [esp+0x4], [esp+0x8])")
 OneGadget::Gadget.add(build_id, 609159,
                       constraints: ["ebx is the GOT address of libc", "[esp+0x8] == NULL"],
                       effect: "execl(\"/bin/sh\", \"sh\", [esp+0x8])")