one_gadget 2.0.0 → 2.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (49) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +197 -65
  3. data/README.md +96 -22
  4. data/lib/one_gadget/abi.rb +41 -5
  5. data/lib/one_gadget/builds/libc-2.31-93b46e0027747153e336c3fd9431ce9a5d82ad00.rb +563 -0
  6. data/lib/one_gadget/builds/libc-2.35-891c1403437a4e30e684e0c8e34b87a09e4298e5.rb +434 -0
  7. data/lib/one_gadget/builds/libc-2.39-a1d1cf4badf1f5dfe57ff1d17bd692ccc6fcd5c5.rb +531 -0
  8. data/lib/one_gadget/builds/libc-2.39-cd8f5a207dd67aea370d2b471a54c3e56f44ab18.rb +531 -0
  9. data/lib/one_gadget/builds/libc-2.43-b50ceafbd17dc6bceee344a66671c7eaa152bef4.rb +15 -0
  10. data/lib/one_gadget/emulators/aarch64.rb +5 -2
  11. data/lib/one_gadget/emulators/amd64.rb +1 -0
  12. data/lib/one_gadget/emulators/arm.rb +27 -18
  13. data/lib/one_gadget/emulators/arm_family.rb +35 -160
  14. data/lib/one_gadget/emulators/conditional.rb +28 -22
  15. data/lib/one_gadget/emulators/constraints.rb +269 -0
  16. data/lib/one_gadget/emulators/data_processing.rb +167 -0
  17. data/lib/one_gadget/emulators/i386.rb +4 -6
  18. data/lib/one_gadget/emulators/instruction.rb +24 -1
  19. data/lib/one_gadget/emulators/lambda.rb +3 -1
  20. data/lib/one_gadget/emulators/mips.rb +289 -0
  21. data/lib/one_gadget/emulators/processor.rb +33 -455
  22. data/lib/one_gadget/emulators/register_file.rb +19 -10
  23. data/lib/one_gadget/emulators/riscv64.rb +265 -0
  24. data/lib/one_gadget/emulators/safe_calls.rb +9 -3
  25. data/lib/one_gadget/emulators/tracked_memory.rb +209 -0
  26. data/lib/one_gadget/emulators/x86.rb +32 -22
  27. data/lib/one_gadget/fetchers/aarch64.rb +0 -27
  28. data/lib/one_gadget/fetchers/amd64.rb +0 -24
  29. data/lib/one_gadget/fetchers/argument_resolution.rb +340 -0
  30. data/lib/one_gadget/fetchers/arm.rb +99 -44
  31. data/lib/one_gadget/fetchers/base.rb +142 -640
  32. data/lib/one_gadget/fetchers/candidate_walk.rb +150 -0
  33. data/lib/one_gadget/fetchers/disassembly.rb +252 -0
  34. data/lib/one_gadget/fetchers/dynamic_symbols.rb +104 -0
  35. data/lib/one_gadget/fetchers/i386.rb +5 -8
  36. data/lib/one_gadget/fetchers/mips.rb +478 -0
  37. data/lib/one_gadget/fetchers/objdump.rb +24 -2
  38. data/lib/one_gadget/fetchers/riscv64.rb +78 -0
  39. data/lib/one_gadget/fetchers/x86.rb +19 -0
  40. data/lib/one_gadget/fetchers.rb +22 -6
  41. data/lib/one_gadget/gadget.rb +25 -34
  42. data/lib/one_gadget/helper.rb +19 -5
  43. data/lib/one_gadget/one_gadget.rb +6 -0
  44. data/lib/one_gadget/version.rb +1 -1
  45. data/lib/one_gadget.rb +1 -1
  46. metadata +18 -6
  47. data/lib/one_gadget/builds/libc-2.26-2104f3d4ad5cf68603afbe7ba1a17f5ac99c5988.rb +0 -227
  48. data/lib/one_gadget/builds/libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2.rb +0 -300
  49. data/lib/one_gadget/builds/libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252.rb +0 -199
data/lib/one_gadget/builds/libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2.rb DELETED
@@ -1,300 +0,0 @@
1
- require 'one_gadget/gadget'
2
- # spec/data/libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2.so
3
- #
4
- # Advanced Micro Devices X86-64 processor
5
- #
6
- # GNU C Library (Ubuntu GLIBC 2.26-0ubuntu2.1) stable release version 2.26, by Roland McGrath et al.
7
- # Copyright (C) 2017 Free Software Foundation, Inc.
8
- # This is free software; see the source for copying conditions.
9
- # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
- # PARTICULAR PURPOSE.
11
- # Compiled by GNU CC version 6.4.0 20171010.
12
- # Available extensions:
13
- # crypt add-on version 2.1 by Michael Glad and others
14
- # GNU Libidn by Simon Josefsson
15
- # Native POSIX Threads Library by Ulrich Drepper et al
16
- # BIND-8.2.3-T5B
17
- # libc ABIs: UNIQUE IFUNC
18
- # For bug reporting instructions, please see:
19
- # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
-
21
- build_id = File.basename(__FILE__, '.rb').split('-').last
22
- OneGadget::Gadget.add(build_id, 293259,
23
- constraints: ["(u64)rax <= 0xfffffffffffff000", "eax == 0x0", "r12 == NULL", "{\"sh\", \"-c\", rbx, NULL} is a valid argv"],
24
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
25
- OneGadget::Gadget.add(build_id, 293271,
26
- constraints: ["eax == 0x0", "r12 == NULL", "{\"sh\", \"-c\", rbx, NULL} is a valid argv"],
27
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
28
- OneGadget::Gadget.add(build_id, 293951,
29
- constraints: ["r12 == NULL", "{\"sh\", \"-c\", rbx, NULL} is a valid argv"],
30
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
31
- OneGadget::Gadget.add(build_id, 293958,
32
- constraints: ["r12 == NULL", "rax == NULL || {rax, \"-c\", rbx, NULL} is a valid argv"],
33
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
34
- OneGadget::Gadget.add(build_id, 293965,
35
- constraints: ["r12 == NULL", "rsi == NULL", "rax == NULL || {rax, \"-c\", rbx, NULL} is a valid argv"],
36
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
37
- OneGadget::Gadget.add(build_id, 293967,
38
- constraints: ["r12 == NULL", "rdx == NULL", "rsi == NULL", "rax == NULL || {rax, \"-c\", rbx, NULL} is a valid argv"],
39
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
40
- OneGadget::Gadget.add(build_id, 293972,
41
- constraints: ["r12 == NULL", "rdx == NULL", "rsi == NULL", "rax == NULL || {rax, \"-c\", rbx, NULL} is a valid argv"],
42
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
43
- OneGadget::Gadget.add(build_id, 293977,
44
- constraints: ["r12 == NULL", "rdx == NULL", "rsi == NULL", "rax == NULL || {rax, \"-c\", [rsp+0x40], NULL} is a valid argv"],
45
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
46
- OneGadget::Gadget.add(build_id, 293986,
47
- constraints: ["r12 == NULL", "rdx == NULL", "rsi == NULL", "rax == NULL || {rax, \"-c\", [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
48
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
49
- OneGadget::Gadget.add(build_id, 293991,
50
- constraints: ["r12 == NULL", "rdx == NULL", "rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], \"-c\", [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
51
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
52
- OneGadget::Gadget.add(build_id, 293998,
53
- constraints: ["r12 == NULL", "rdx == NULL", "rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], rax, [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
54
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
55
- OneGadget::Gadget.add(build_id, 294003,
56
- constraints: ["r12 == NULL", "rdx == NULL", "rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
57
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
58
- OneGadget::Gadget.add(build_id, 294008,
59
- constraints: ["r12 == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
60
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
61
- OneGadget::Gadget.add(build_id, 294015,
62
- constraints: ["r12 == NULL", "rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
63
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
64
- OneGadget::Gadget.add(build_id, 294017,
65
- constraints: ["r12 == NULL", "rdx == NULL", "rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
66
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
67
- OneGadget::Gadget.add(build_id, 294022,
68
- constraints: ["r12 == NULL", "rdx == NULL", "rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
69
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
70
- OneGadget::Gadget.add(build_id, 294027,
71
- constraints: ["r12 == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
72
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
73
- OneGadget::Gadget.add(build_id, 294029,
74
- constraints: ["r12 == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
75
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
76
- OneGadget::Gadget.add(build_id, 294032,
77
- constraints: ["rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
78
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
79
- OneGadget::Gadget.add(build_id, 294037,
80
- constraints: ["rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
81
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
82
- OneGadget::Gadget.add(build_id, 294042,
83
- constraints: ["[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
84
- effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
85
- OneGadget::Gadget.add(build_id, 294049,
86
- constraints: ["readable: rax", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv", "[[rax]] == NULL || [rax] == NULL || [rax] is a valid envp"],
87
- effect: "execve(\"/bin/sh\", rsp+0x30, [rax])")
88
- OneGadget::Gadget.add(build_id, 890584,
89
- constraints: ["[r15] == 0x0", "writable: rbp-0x50", "r14 == NULL || {\"/bin/sh\", r14, NULL} is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
90
- effect: "execve(\"/bin/sh\", rbp-0x50, rbx)")
91
- OneGadget::Gadget.add(build_id, 890592,
92
- constraints: ["[r15] == 0x0", "writable: rbp-0x50", "r14 == NULL || {\"/bin/sh\", r14, NULL} is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
93
- effect: "execve(\"/bin/sh\", rbp-0x50, rbx)")
94
- OneGadget::Gadget.add(build_id, 890594,
95
- constraints: ["[r15] == 0x0", "writable: rbp-0x50", "r14 == NULL || {\"/bin/sh\", r14, NULL} is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
96
- effect: "execve(\"/bin/sh\", rbp-0x50, rbx)")
97
- OneGadget::Gadget.add(build_id, 890600,
98
- constraints: ["writable: rbp-0x50", "r14 == NULL || {\"/bin/sh\", r14, NULL} is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
99
- effect: "execve(\"/bin/sh\", rbp-0x50, rbx)")
100
- OneGadget::Gadget.add(build_id, 890642,
101
- constraints: ["rax == 0x1", "writable: rbp-0x50", "r14 == NULL || {\"/bin/sh\", r14, NULL} is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
102
- effect: "execve(\"/bin/sh\", rbp-0x50, rbx)")
103
- OneGadget::Gadget.add(build_id, 890723,
104
- constraints: ["[r13] == NULL || r13 == NULL || r13 is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
105
- effect: "execve(\"/bin/sh\", r13, rbx)")
106
- OneGadget::Gadget.add(build_id, 891005,
107
- constraints: ["writable: rbp-0x50", "r14 == NULL || {\"/bin/sh\", r14, NULL} is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
108
- effect: "execve(\"/bin/sh\", rbp-0x50, rbx)")
109
- OneGadget::Gadget.add(build_id, 891008,
110
- constraints: ["writable: rbp-0x50", "r14 == NULL || {\"/bin/sh\", r14, NULL} is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
111
- effect: "execve(\"/bin/sh\", rbp-0x50, rbx)")
112
- OneGadget::Gadget.add(build_id, 891015,
113
- constraints: ["writable: rbp-0x50", "rax == NULL || {rax, r14, NULL} is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
114
- effect: "execve(\"/bin/sh\", rbp-0x50, rbx)")
115
- OneGadget::Gadget.add(build_id, 891018,
116
- constraints: ["writable: rbp-0x50", "rax == NULL || {rax, r14, NULL} is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
117
- effect: "execve(\"/bin/sh\", rbp-0x50, rbx)")
118
- OneGadget::Gadget.add(build_id, 891022,
119
- constraints: ["writable: rbp-0x50", "rax == NULL || {rax, [rbp-0x48], NULL} is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
120
- effect: "execve(\"/bin/sh\", rbp-0x50, rbx)")
121
- OneGadget::Gadget.add(build_id, 891030,
122
- constraints: ["writable: rbp-0x50", "rax == NULL || {rax, [rbp-0x48], [rbp-0x40], [rbp-0x38], ...} is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
123
- effect: "execve(\"/bin/sh\", rbp-0x50, rbx)")
124
- OneGadget::Gadget.add(build_id, 891034,
125
- constraints: ["writable: rbp-0x50", "[r13] == NULL || r13 == NULL || r13 is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
126
- effect: "execve(\"/bin/sh\", r13, rbx)")
127
- OneGadget::Gadget.add(build_id, 891038,
128
- constraints: ["[r13] == NULL || r13 == NULL || r13 is a valid argv", "[rbx] == NULL || rbx == NULL || rbx is a valid envp"],
129
- effect: "execve(\"/bin/sh\", r13, rbx)")
130
- OneGadget::Gadget.add(build_id, 891143,
131
- constraints: ["[r15] == 0x0", "eax == 0x8", "writable: rbp-0x98", "[[rbp-0x90]] == NULL || [rbp-0x90] == NULL || [rbp-0x90] is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
132
- effect: "execve(\"/bin/sh\", [rbp-0x90], [rbp-0x70])")
133
- OneGadget::Gadget.add(build_id, 891290,
134
- constraints: ["[r15] == 0x0", "writable: rbp-0x98", "[[rbp-0x90]] == NULL || [rbp-0x90] == NULL || [rbp-0x90] is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
135
- effect: "execve(\"/bin/sh\", [rbp-0x90], [rbp-0x70])")
136
- OneGadget::Gadget.add(build_id, 891292,
137
- constraints: ["[r15] == 0x0", "writable: rbp-0x98", "[[rbp-0x90]] == NULL || [rbp-0x90] == NULL || [rbp-0x90] is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
138
- effect: "execve(\"/bin/sh\", [rbp-0x90], [rbp-0x70])")
139
- OneGadget::Gadget.add(build_id, 891298,
140
- constraints: ["writable: rbp-0x98", "[[rbp-0x90]] == NULL || [rbp-0x90] == NULL || [rbp-0x90] is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
141
- effect: "execve(\"/bin/sh\", [rbp-0x90], [rbp-0x70])")
142
- OneGadget::Gadget.add(build_id, 891342,
143
- constraints: ["rax == 0x1", "writable: rbp-0x98", "[[rbp-0x90]] == NULL || [rbp-0x90] == NULL || [rbp-0x90] is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
144
- effect: "execve(\"/bin/sh\", [rbp-0x90], [rbp-0x70])")
145
- OneGadget::Gadget.add(build_id, 891441,
146
- constraints: ["readable: rbp-0xa0", "[[rbp-0xa0]] == NULL || [rbp-0xa0] == NULL || [rbp-0xa0] is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
147
- effect: "execve(\"/bin/sh\", [rbp-0xa0], [rbp-0x70])")
148
- OneGadget::Gadget.add(build_id, 891448,
149
- constraints: ["readable: rbp-0x70", "[rcx] == NULL || rcx == NULL || rcx is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
150
- effect: "execve(\"/bin/sh\", rcx, [rbp-0x70])")
151
- OneGadget::Gadget.add(build_id, 891452,
152
- constraints: ["[rcx] == NULL || rcx == NULL || rcx is a valid argv", "[rdx] == NULL || rdx == NULL || rdx is a valid envp"],
153
- effect: "execve(\"/bin/sh\", rcx, rdx)")
154
- OneGadget::Gadget.add(build_id, 891484,
155
- constraints: ["writable: rbp-0x98", "[[rbp-0x90]] == NULL || [rbp-0x90] == NULL || [rbp-0x90] is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
156
- effect: "execve(\"/bin/sh\", [rbp-0x90], [rbp-0x70])")
157
- OneGadget::Gadget.add(build_id, 891491,
158
- constraints: ["writable: rbp-0x98", "[[rbp-0x90]] == NULL || [rbp-0x90] == NULL || [rbp-0x90] is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
159
- effect: "execve(\"/bin/sh\", [rbp-0x90], [rbp-0x70])")
160
- OneGadget::Gadget.add(build_id, 891498,
161
- constraints: ["writable: rbp-0x50", "[[rbp-0x90]] == NULL || [rbp-0x90] == NULL || [rbp-0x90] is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
162
- effect: "execve(\"/bin/sh\", [rbp-0x90], [rbp-0x70])")
163
- OneGadget::Gadget.add(build_id, 891506,
164
- constraints: ["writable: rbp-0x50", "[[rbp-0x90]] == NULL || [rbp-0x90] == NULL || [rbp-0x90] is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
165
- effect: "execve(\"/bin/sh\", [rbp-0x90], [rbp-0x70])")
166
- OneGadget::Gadget.add(build_id, 891513,
167
- constraints: ["writable: rbp-0x50", "[rcx] == NULL || rcx == NULL || rcx is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
168
- effect: "execve(\"/bin/sh\", rcx, [rbp-0x70])")
169
- OneGadget::Gadget.add(build_id, 891517,
170
- constraints: ["writable: rbp-0x48", "[rcx] == NULL || rcx == NULL || rcx is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
171
- effect: "execve(\"/bin/sh\", rcx, [rbp-0x70])")
172
- OneGadget::Gadget.add(build_id, 891521,
173
- constraints: ["writable: rbp-0x48", "[rcx] == NULL || rcx == NULL || rcx is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
174
- effect: "execve(\"/bin/sh\", rcx, [rbp-0x70])")
175
- OneGadget::Gadget.add(build_id, 891525,
176
- constraints: ["readable: rbp-0x70", "[rcx] == NULL || rcx == NULL || rcx is a valid argv", "[[rbp-0x70]] == NULL || [rbp-0x70] == NULL || [rbp-0x70] is a valid envp"],
177
- effect: "execve(\"/bin/sh\", rcx, [rbp-0x70])")
178
- OneGadget::Gadget.add(build_id, 1035233,
179
- constraints: ["[rsp+0x28] != 0x0", "[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
180
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)",
181
- closed_fds: ["[rsp+0x3c]", "[rsp+0x38]"])
182
- OneGadget::Gadget.add(build_id, 1035237,
183
- constraints: ["[rsp+0x28] != 0x0", "[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
184
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)",
185
- closed_fds: ["rdi", "[rsp+0x38]"])
186
- OneGadget::Gadget.add(build_id, 1035242,
187
- constraints: ["[rsp+0x28] != 0x0", "[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
188
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)",
189
- closed_fds: ["[rsp+0x38]"])
190
- OneGadget::Gadget.add(build_id, 1035246,
191
- constraints: ["ecx != 0x0", "[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
192
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)",
193
- closed_fds: ["[rsp+0x38]"])
194
- OneGadget::Gadget.add(build_id, 1035318,
195
- constraints: ["([rsp+0x78] & 0xf000) == 0x2000", "[rsp+0x88] == 0x103", "eax == 0x0", "[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
196
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)",
197
- closed_fds: ["[rsp+0x38]"])
198
- OneGadget::Gadget.add(build_id, 1035322,
199
- constraints: ["([rsp+0x78] & 0xf000) == 0x2000", "[rsp+0x88] == 0x103", "[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
200
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)",
201
- closed_fds: ["[rsp+0x38]"])
202
- OneGadget::Gadget.add(build_id, 1035326,
203
- constraints: ["(eax & 0xf000) == 0x2000", "[rsp+0x88] == 0x103", "[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
204
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)",
205
- closed_fds: ["[rsp+0x38]"])
206
- OneGadget::Gadget.add(build_id, 1035331,
207
- constraints: ["[rsp+0x88] == 0x103", "eax == 0x2000", "[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
208
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)",
209
- closed_fds: ["[rsp+0x38]"])
210
- OneGadget::Gadget.add(build_id, 1035338,
211
- constraints: ["[rsp+0x88] == 0x103", "[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
212
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)",
213
- closed_fds: ["[rsp+0x38]"])
214
- OneGadget::Gadget.add(build_id, 1035460,
215
- constraints: ["[rsp+0x28] != 0x0", "[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
216
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)",
217
- closed_fds: ["[rsp+0x38]"])
218
- OneGadget::Gadget.add(build_id, 1035465,
219
- constraints: ["[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
220
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)",
221
- closed_fds: ["[rsp+0x38]"])
222
- OneGadget::Gadget.add(build_id, 1035477,
223
- constraints: ["[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
224
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)",
225
- closed_fds: ["[rsp+0x38]"])
226
- OneGadget::Gadget.add(build_id, 1035481,
227
- constraints: ["[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
228
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)",
229
- closed_fds: ["rdi"])
230
- OneGadget::Gadget.add(build_id, 1035486,
231
- constraints: ["[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv"],
232
- effect: "execve(\"/bin/sh\", rsp+0x40, environ)")
233
- OneGadget::Gadget.add(build_id, 1035493,
234
- constraints: ["readable: rax", "[rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv", "[[rax]] == NULL || [rax] == NULL || [rax] is a valid envp"],
235
- effect: "execve(\"/bin/sh\", rsp+0x40, [rax])")
236
- OneGadget::Gadget.add(build_id, 1035498,
237
- constraints: ["readable: rax", "[rsi] == NULL || rsi == NULL || rsi is a valid argv", "[[rax]] == NULL || [rax] == NULL || [rax] is a valid envp"],
238
- effect: "execve(\"/bin/sh\", rsi, [rax])")
239
- OneGadget::Gadget.add(build_id, 1039021,
240
- constraints: ["[rsp+0x34] != 0x0", "[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
241
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)",
242
- closed_fds: ["[rsp+0x6c]", "[rsp+0x68]"])
243
- OneGadget::Gadget.add(build_id, 1039025,
244
- constraints: ["[rsp+0x34] != 0x0", "[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
245
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)",
246
- closed_fds: ["rdi", "[rsp+0x68]"])
247
- OneGadget::Gadget.add(build_id, 1039030,
248
- constraints: ["[rsp+0x34] != 0x0", "[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
249
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)",
250
- closed_fds: ["[rsp+0x68]"])
251
- OneGadget::Gadget.add(build_id, 1039034,
252
- constraints: ["ecx != 0x0", "[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
253
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)",
254
- closed_fds: ["[rsp+0x68]"])
255
- OneGadget::Gadget.add(build_id, 1039124,
256
- constraints: ["([rsp+0xa8] & 0xf000) == 0x2000", "[rsp+0xb8] == 0x103", "eax == 0x0", "[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
257
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)",
258
- closed_fds: ["[rsp+0x68]"])
259
- OneGadget::Gadget.add(build_id, 1039128,
260
- constraints: ["([rsp+0xa8] & 0xf000) == 0x2000", "[rsp+0xb8] == 0x103", "[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
261
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)",
262
- closed_fds: ["[rsp+0x68]"])
263
- OneGadget::Gadget.add(build_id, 1039135,
264
- constraints: ["(eax & 0xf000) == 0x2000", "[rsp+0xb8] == 0x103", "[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
265
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)",
266
- closed_fds: ["[rsp+0x68]"])
267
- OneGadget::Gadget.add(build_id, 1039140,
268
- constraints: ["[rsp+0xb8] == 0x103", "eax == 0x2000", "[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
269
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)",
270
- closed_fds: ["[rsp+0x68]"])
271
- OneGadget::Gadget.add(build_id, 1039147,
272
- constraints: ["[rsp+0xb8] == 0x103", "[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
273
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)",
274
- closed_fds: ["[rsp+0x68]"])
275
- OneGadget::Gadget.add(build_id, 1039225,
276
- constraints: ["[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
277
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)",
278
- closed_fds: ["[rsp+0x68]"])
279
- OneGadget::Gadget.add(build_id, 1039237,
280
- constraints: ["[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
281
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)",
282
- closed_fds: ["[rsp+0x68]"])
283
- OneGadget::Gadget.add(build_id, 1039241,
284
- constraints: ["[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
285
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)",
286
- closed_fds: ["rdi"])
287
- OneGadget::Gadget.add(build_id, 1039246,
288
- constraints: ["[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
289
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)")
290
- OneGadget::Gadget.add(build_id, 1039253,
291
- constraints: ["readable: rax", "[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv", "[[rax]] == NULL || [rax] == NULL || [rax] is a valid envp"],
292
- effect: "execve(\"/bin/sh\", rsp+0x70, [rax])")
293
- OneGadget::Gadget.add(build_id, 1039258,
294
- constraints: ["readable: rax", "[rsi] == NULL || rsi == NULL || rsi is a valid argv", "[[rax]] == NULL || [rax] == NULL || [rax] is a valid envp"],
295
- effect: "execve(\"/bin/sh\", rsi, [rax])")
296
- OneGadget::Gadget.add(build_id, 1039351,
297
- constraints: ["[rsp+0x34] != 0x0", "[rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv"],
298
- effect: "execve(\"/bin/sh\", rsp+0x70, environ)",
299
- closed_fds: ["[rsp+0x68]"])
300
-
data/lib/one_gadget/builds/libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252.rb DELETED
@@ -1,199 +0,0 @@
1
- require 'one_gadget/gadget'
2
- # spec/data/libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252.so
3
- #
4
- # Intel 80386
5
- #
6
- # GNU C Library (Ubuntu GLIBC 2.26-0ubuntu2.1) stable release version 2.26, by Roland McGrath et al.
7
- # Copyright (C) 2017 Free Software Foundation, Inc.
8
- # This is free software; see the source for copying conditions.
9
- # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
- # PARTICULAR PURPOSE.
11
- # Compiled by GNU CC version 6.4.0 20171010.
12
- # Available extensions:
13
- # crypt add-on version 2.1 by Michael Glad and others
14
- # GNU Libidn by Simon Josefsson
15
- # Native POSIX Threads Library by Ulrich Drepper et al
16
- # BIND-8.2.3-T5B
17
- # libc ABIs: UNIQUE IFUNC
18
- # For bug reporting instructions, please see:
19
- # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
20
-
21
- build_id = File.basename(__FILE__, '.rb').split('-').last
22
- OneGadget::Gadget.add(build_id, 248197,
23
- constraints: ["esi is the GOT address of libc", "[esp+0xc] == NULL", "eax == 0x0", "{\"sh\", \"-c\", ebp, NULL} is a valid argv"],
24
- effect: "execve(\"/bin/sh\", esp+0x30, environ)")
25
- OneGadget::Gadget.add(build_id, 248208,
26
- constraints: ["esi is the GOT address of libc", "[esp+0xc] == NULL", "eax == 0x0", "{\"sh\", \"-c\", ebp, NULL} is a valid argv"],
27
- effect: "execve(\"/bin/sh\", esp+0x30, environ)")
28
- OneGadget::Gadget.add(build_id, 248610,
29
- constraints: ["esi is the GOT address of libc", "[esp+0xc] == NULL", "eax == 0x0", "{\"sh\", \"-c\", ebp, NULL} is a valid argv"],
30
- effect: "execve(\"/bin/sh\", esp+0x30, environ)")
31
- OneGadget::Gadget.add(build_id, 248804,
32
- constraints: ["esi is the GOT address of libc", "[esp+0xc] == NULL", "{\"sh\", \"-c\", ebp, NULL} is a valid argv"],
33
- effect: "execve(\"/bin/sh\", esp+0x30, environ)")
34
- OneGadget::Gadget.add(build_id, 248810,
35
- constraints: ["esi is the GOT address of libc", "[esp+0xc] == NULL", "eax == NULL || {eax, \"-c\", ebp, NULL} is a valid argv"],
36
- effect: "execve(\"/bin/sh\", esp+0x30, environ)")
37
- OneGadget::Gadget.add(build_id, 248814,
38
- constraints: ["esi is the GOT address of libc", "[esp+0xc] == NULL", "eax == NULL || {eax, \"-c\", [esp+0x38], NULL} is a valid argv"],
39
- effect: "execve(\"/bin/sh\", esp+0x30, environ)")
40
- OneGadget::Gadget.add(build_id, 248822,
41
- constraints: ["esi is the GOT address of libc", "[esp+0xc] == NULL", "eax == NULL || {eax, \"-c\", [esp+0x38], [esp+0x3c], ...} is a valid argv"],
42
- effect: "execve(\"/bin/sh\", esp+0x30, environ)")
43
- OneGadget::Gadget.add(build_id, 248825,
44
- constraints: ["esi is the GOT address of libc", "[esp+0x10] == NULL", "eax == NULL || {eax, \"-c\", [esp+0x3c], [esp+0x40], ...} is a valid argv"],
45
- effect: "execve(\"/bin/sh\", esp+0x34, environ)")
46
- OneGadget::Gadget.add(build_id, 248827,
47
- constraints: ["esi is the GOT address of libc", "[esp+0x10] == NULL", "eax == NULL || {eax, \"-c\", [esp+0x3c], [esp+0x40], ...} is a valid argv"],
48
- effect: "execve(\"/bin/sh\", esp+0x34, environ)")
49
- OneGadget::Gadget.add(build_id, 248831,
50
- constraints: ["esi is the GOT address of libc", "[esp+0x10] == NULL", "[esp+0x34] == NULL || {[esp+0x34], \"-c\", [esp+0x3c], [esp+0x40], ...} is a valid argv"],
51
- effect: "execve(\"/bin/sh\", esp+0x34, environ)")
52
- OneGadget::Gadget.add(build_id, 248837,
53
- constraints: ["esi is the GOT address of libc", "[esp+0x10] == NULL", "[esp+0x34] == NULL || {[esp+0x34], eax, [esp+0x3c], [esp+0x40], ...} is a valid argv"],
54
- effect: "execve(\"/bin/sh\", esp+0x34, environ)")
55
- OneGadget::Gadget.add(build_id, 248841,
56
- constraints: ["esi is the GOT address of libc", "[esp+0x10] == NULL", "[esp+0x34] == NULL || {[esp+0x34], [esp+0x38], [esp+0x3c], [esp+0x40], ...} is a valid argv"],
57
- effect: "execve(\"/bin/sh\", esp+0x34, environ)")
58
- OneGadget::Gadget.add(build_id, 248847,
59
- constraints: ["esi is the GOT address of libc", "[esp+0x10] == NULL", "eax == NULL", "[esp+0x34] == NULL || {[esp+0x34], [esp+0x38], [esp+0x3c], [esp+0x40], ...} is a valid argv"],
60
- effect: "execve(\"/bin/sh\", esp+0x34, environ)")
61
- OneGadget::Gadget.add(build_id, 248849,
62
- constraints: ["esi is the GOT address of libc", "[esp+0x14] == NULL", "[esp] == NULL", "eax == NULL", "[esp+0x38] == NULL || {[esp+0x38], [esp+0x3c], [esp+0x40], [esp+0x44], ...} is a valid argv"],
63
- effect: "execve(\"/bin/sh\", esp+0x38, environ)")
64
- OneGadget::Gadget.add(build_id, 248850,
65
- constraints: ["esi is the GOT address of libc", "[esp+0x18] == NULL", "[esp+0x4] == NULL", "[esp] == NULL", "[esp+0x3c] == NULL || {[esp+0x3c], [esp+0x40], [esp+0x44], [esp+0x48], ...} is a valid argv"],
66
- effect: "execve(\"/bin/sh\", esp+0x3c, environ)")
67
- OneGadget::Gadget.add(build_id, 248852,
68
- constraints: ["esi is the GOT address of libc", "[esp+0x1c] == NULL", "[esp+0x4] == NULL", "[esp+0x8] == NULL", "[esp+0x40] == NULL || {[esp+0x40], [esp+0x44], [esp+0x48], [esp+0x4c], ...} is a valid argv"],
69
- effect: "execve(\"/bin/sh\", esp+0x40, environ)")
70
- OneGadget::Gadget.add(build_id, 248857,
71
- constraints: ["esi is the GOT address of libc", "[esp+0x1c] == NULL", "[esp+0x40] == NULL || {[esp+0x40], [esp+0x44], [esp+0x48], [esp+0x4c], ...} is a valid argv"],
72
- effect: "execve(\"/bin/sh\", esp+0x40, environ)")
73
- OneGadget::Gadget.add(build_id, 248863,
74
- constraints: ["esi is the GOT address of libc", "[esp+0x1c] == NULL", "eax == NULL", "[esp+0x40] == NULL || {[esp+0x40], [esp+0x44], [esp+0x48], [esp+0x4c], ...} is a valid argv"],
75
- effect: "execve(\"/bin/sh\", esp+0x40, environ)")
76
- OneGadget::Gadget.add(build_id, 248866,
77
- constraints: ["esi is the GOT address of libc", "[esp+0x10] == NULL", "eax == NULL", "[esp+0x34] == NULL || {[esp+0x34], [esp+0x38], [esp+0x3c], [esp+0x40], ...} is a valid argv"],
78
- effect: "execve(\"/bin/sh\", esp+0x34, environ)")
79
- OneGadget::Gadget.add(build_id, 248868,
80
- constraints: ["esi is the GOT address of libc", "[esp+0x14] == NULL", "[esp] == NULL", "eax == NULL", "[esp+0x38] == NULL || {[esp+0x38], [esp+0x3c], [esp+0x40], [esp+0x44], ...} is a valid argv"],
81
- effect: "execve(\"/bin/sh\", esp+0x38, environ)")
82
- OneGadget::Gadget.add(build_id, 248869,
83
- constraints: ["esi is the GOT address of libc", "[esp+0x18] == NULL", "[esp+0x4] == NULL", "[esp] == NULL", "[esp+0x3c] == NULL || {[esp+0x3c], [esp+0x40], [esp+0x44], [esp+0x48], ...} is a valid argv"],
84
- effect: "execve(\"/bin/sh\", esp+0x3c, environ)")
85
- OneGadget::Gadget.add(build_id, 248871,
86
- constraints: ["esi is the GOT address of libc", "[esp+0x1c] == NULL", "[esp+0x4] == NULL", "[esp+0x8] == NULL", "[esp+0x40] == NULL || {[esp+0x40], [esp+0x44], [esp+0x48], [esp+0x4c], ...} is a valid argv"],
87
- effect: "execve(\"/bin/sh\", esp+0x40, environ)")
88
- OneGadget::Gadget.add(build_id, 248876,
89
- constraints: ["esi is the GOT address of libc", "[esp+0x1c] == NULL", "[esp+0x40] == NULL || {[esp+0x40], [esp+0x44], [esp+0x48], [esp+0x4c], ...} is a valid argv"],
90
- effect: "execve(\"/bin/sh\", esp+0x40, environ)")
91
- OneGadget::Gadget.add(build_id, 248879,
92
- constraints: ["esi is the GOT address of libc", "[esp+0x10] == NULL", "[esp+0x34] == NULL || {[esp+0x34], [esp+0x38], [esp+0x3c], [esp+0x40], ...} is a valid argv"],
93
- effect: "execve(\"/bin/sh\", esp+0x34, environ)")
94
- OneGadget::Gadget.add(build_id, 248881,
95
- constraints: ["esi is the GOT address of libc", "[esp+0x14] == NULL", "[esp+0x38] == NULL || {[esp+0x38], [esp+0x3c], [esp+0x40], [esp+0x44], ...} is a valid argv"],
96
- effect: "execve(\"/bin/sh\", esp+0x38, environ)")
97
- OneGadget::Gadget.add(build_id, 248885,
98
- constraints: ["esi is the GOT address of libc", "[esp] == NULL", "[esp+0x3c] == NULL || {[esp+0x3c], [esp+0x40], [esp+0x44], [esp+0x48], ...} is a valid argv"],
99
- effect: "execve(\"/bin/sh\", esp+0x3c, environ)")
100
- OneGadget::Gadget.add(build_id, 248887,
101
- constraints: ["esi is the GOT address of libc", "[esp+0x4] == NULL", "[esp+0x40] == NULL || {[esp+0x40], [esp+0x44], [esp+0x48], [esp+0x4c], ...} is a valid argv"],
102
- effect: "execve(\"/bin/sh\", esp+0x40, environ)")
103
- OneGadget::Gadget.add(build_id, 248892,
104
- constraints: ["esi is the GOT address of libc", "[esp+0x40] == NULL || {[esp+0x40], [esp+0x44], [esp+0x48], [esp+0x4c], ...} is a valid argv"],
105
- effect: "execve(\"/bin/sh\", esp+0x40, environ)")
106
- OneGadget::Gadget.add(build_id, 248898,
107
- constraints: ["esi is the GOT address of libc", "[esp+0x40] == NULL || {[esp+0x40], [esp+0x44], [esp+0x48], [esp+0x4c], ...} is a valid argv", "[[eax]] == NULL || [eax] == NULL || [eax] is a valid envp"],
108
- effect: "execve(\"/bin/sh\", esp+0x40, [eax])")
109
- OneGadget::Gadget.add(build_id, 248901,
110
- constraints: ["esi is the GOT address of libc", "[esp+0x34] == NULL || {[esp+0x34], [esp+0x38], [esp+0x3c], [esp+0x40], ...} is a valid argv", "[[eax]] == NULL || [eax] == NULL || [eax] is a valid envp"],
111
- effect: "execve(\"/bin/sh\", esp+0x34, [eax])")
112
- OneGadget::Gadget.add(build_id, 248911,
113
- constraints: ["esi is the GOT address of libc", "[esp+0x34] == NULL || {[esp+0x34], [esp+0x38], [esp+0x3c], [esp+0x40], ...} is a valid argv", "[[eax]] == NULL || [eax] == NULL || [eax] is a valid envp"],
114
- effect: "execve(\"/bin/sh\", esp+0x34, [eax])")
115
- OneGadget::Gadget.add(build_id, 248921,
116
- constraints: ["esi is the GOT address of libc", "[esp+0x34] == NULL || {[esp+0x34], [esp+0x38], [esp+0x3c], [esp+0x40], ...} is a valid argv", "[[eax]] == NULL || [eax] == NULL || [eax] is a valid envp"],
117
- effect: "execve(\"/bin/sh\", esp+0x34, [eax])")
118
- OneGadget::Gadget.add(build_id, 248923,
119
- constraints: ["esi is the GOT address of libc", "[esp+0x38] == NULL || {[esp+0x38], [esp+0x3c], [esp+0x40], [esp+0x44], ...} is a valid argv", "[[esp]] == NULL || [esp] == NULL || [esp] is a valid envp"],
120
- effect: "execve(\"/bin/sh\", esp+0x38, [esp])")
121
- OneGadget::Gadget.add(build_id, 248927,
122
- constraints: ["esi is the GOT address of libc", "[eax] == NULL || eax == NULL || eax is a valid argv", "[[esp]] == NULL || [esp] == NULL || [esp] is a valid envp"],
123
- effect: "execve(\"/bin/sh\", eax, [esp])")
124
- OneGadget::Gadget.add(build_id, 248928,
125
- constraints: ["esi is the GOT address of libc", "[[esp]] == NULL || [esp] == NULL || [esp] is a valid argv", "[[esp+0x4]] == NULL || [esp+0x4] == NULL || [esp+0x4] is a valid envp"],
126
- effect: "execve(\"/bin/sh\", [esp], [esp+0x4])")
127
- OneGadget::Gadget.add(build_id, 421487,
128
- constraints: ["edi is the GOT address of libc", "eax == NULL"],
129
- effect: "execl(\"/bin/sh\", \"sh\", eax)")
130
- OneGadget::Gadget.add(build_id, 421490,
131
- constraints: ["edi is the GOT address of libc", "eax == NULL"],
132
- effect: "execl(\"/bin/sh\", \"sh\", eax)")
133
- OneGadget::Gadget.add(build_id, 421492,
134
- constraints: ["edi is the GOT address of libc", "eax == NULL"],
135
- effect: "execl(\"/bin/sh\", \"sh\", eax)")
136
- OneGadget::Gadget.add(build_id, 421496,
137
- constraints: ["edi is the GOT address of libc", "eax == NULL"],
138
- effect: "execl(\"/bin/sh\", \"sh\", eax)")
139
- OneGadget::Gadget.add(build_id, 421497,
140
- constraints: ["edi is the GOT address of libc", "[esp] == NULL"],
141
- effect: "execl(\"/bin/sh\", \"sh\", [esp])")
142
- OneGadget::Gadget.add(build_id, 421503,
143
- constraints: ["edi is the GOT address of libc", "eax == NULL"],
144
- effect: "execl(\"/bin/sh\", eax)")
145
- OneGadget::Gadget.add(build_id, 421504,
146
- constraints: ["edi is the GOT address of libc", "[esp] == NULL"],
147
- effect: "execl(\"/bin/sh\", [esp])")
148
- OneGadget::Gadget.add(build_id, 776801,
149
- constraints: ["ebx is the GOT address of libc", "[edx] == 0x0", "writable: ebp-0x30", "eax == NULL || {\"/bin/sh\", eax, NULL} is a valid argv", "[ecx] == NULL || ecx == NULL || ecx is a valid envp"],
150
- effect: "execve(\"/bin/sh\", [ebp-0x2c], [ebp-0x30])")
151
- OneGadget::Gadget.add(build_id, 776804,
152
- constraints: ["ebx is the GOT address of libc", "[edx] == 0x0", "writable: ebp-0x30", "eax == NULL || {\"/bin/sh\", eax, NULL} is a valid argv", "[ecx] == NULL || ecx == NULL || ecx is a valid envp"],
153
- effect: "execve(\"/bin/sh\", [ebp-0x2c], [ebp-0x30])")
154
- OneGadget::Gadget.add(build_id, 776807,
155
- constraints: ["ebx is the GOT address of libc", "[edx] == 0x0", "writable: ebp-0x2c", "eax == NULL || {\"/bin/sh\", eax, NULL} is a valid argv", "[[ebp-0x30]] == NULL || [ebp-0x30] == NULL || [ebp-0x30] is a valid envp"],
156
- effect: "execve(\"/bin/sh\", [ebp-0x2c], [ebp-0x30])")
157
- OneGadget::Gadget.add(build_id, 776814,
158
- constraints: ["ebx is the GOT address of libc", "[edx] == 0x0", "writable: ebp-0x2c", "eax == NULL || {\"/bin/sh\", eax, NULL} is a valid argv", "[[ebp-0x30]] == NULL || [ebp-0x30] == NULL || [ebp-0x30] is a valid envp"],
159
- effect: "execve(\"/bin/sh\", [ebp-0x2c], [ebp-0x30])")
160
- OneGadget::Gadget.add(build_id, 776817,
161
- constraints: ["ebx is the GOT address of libc", "[edx] == 0x0", "writable: ebp-0x2c", "eax == NULL || {\"/bin/sh\", eax, NULL} is a valid argv", "[[ebp-0x30]] == NULL || [ebp-0x30] == NULL || [ebp-0x30] is a valid envp"],
162
- effect: "execve(\"/bin/sh\", [ebp-0x2c], [ebp-0x30])")
163
- OneGadget::Gadget.add(build_id, 776819,
164
- constraints: ["ebx is the GOT address of libc", "[edx] == 0x0", "writable: ebp-0x2c", "eax == NULL || {\"/bin/sh\", eax, NULL} is a valid argv", "[[ebp-0x30]] == NULL || [ebp-0x30] == NULL || [ebp-0x30] is a valid envp"],
165
- effect: "execve(\"/bin/sh\", [ebp-0x2c], [ebp-0x30])")
166
- OneGadget::Gadget.add(build_id, 776821,
167
- constraints: ["ebx is the GOT address of libc", "ecx == 0x0", "writable: ebp-0x2c", "eax == NULL || {\"/bin/sh\", eax, NULL} is a valid argv", "[[ebp-0x30]] == NULL || [ebp-0x30] == NULL || [ebp-0x30] is a valid envp"],
168
- effect: "execve(\"/bin/sh\", [ebp-0x2c], [ebp-0x30])")
169
- OneGadget::Gadget.add(build_id, 776858,
170
- constraints: ["ebx is the GOT address of libc", "esi == 0x1", "writable: ebp-0x2c", "eax == NULL || {\"/bin/sh\", eax, NULL} is a valid argv", "[[ebp-0x30]] == NULL || [ebp-0x30] == NULL || [ebp-0x30] is a valid envp"],
171
- effect: "execve(\"/bin/sh\", [ebp-0x2c], [ebp-0x30])")
172
- OneGadget::Gadget.add(build_id, 776970,
173
- constraints: ["ebx is the GOT address of libc", "writable: ebp-0x2c", "eax == NULL || {\"/bin/sh\", eax, NULL} is a valid argv", "[[ebp-0x30]] == NULL || [ebp-0x30] == NULL || [ebp-0x30] is a valid envp"],
174
- effect: "execve(\"/bin/sh\", [ebp-0x2c], [ebp-0x30])")
175
- OneGadget::Gadget.add(build_id, 776976,
176
- constraints: ["ebx is the GOT address of libc", "writable: ebp-0x2c", "eax == NULL || {\"/bin/sh\", eax, NULL} is a valid argv", "[[ebp-0x30]] == NULL || [ebp-0x30] == NULL || [ebp-0x30] is a valid envp"],
177
- effect: "execve(\"/bin/sh\", [ebp-0x2c], [ebp-0x30])")
178
- OneGadget::Gadget.add(build_id, 1257393,
179
- constraints: ["esi is the GOT address of libc", "eax == NULL"],
180
- effect: "execl(\"/bin/sh\", \"sh\", eax)")
181
- OneGadget::Gadget.add(build_id, 1257396,
182
- constraints: ["esi is the GOT address of libc", "eax == NULL"],
183
- effect: "execl(\"/bin/sh\", \"sh\", eax)")
184
- OneGadget::Gadget.add(build_id, 1257398,
185
- constraints: ["esi is the GOT address of libc", "eax == NULL"],
186
- effect: "execl(\"/bin/sh\", \"sh\", eax)")
187
- OneGadget::Gadget.add(build_id, 1257399,
188
- constraints: ["esi is the GOT address of libc", "eax == NULL"],
189
- effect: "execl(\"/bin/sh\", \"sh\", eax)")
190
- OneGadget::Gadget.add(build_id, 1257400,
191
- constraints: ["esi is the GOT address of libc", "[esp] == NULL"],
192
- effect: "execl(\"/bin/sh\", \"sh\", [esp])")
193
- OneGadget::Gadget.add(build_id, 1257406,
194
- constraints: ["esi is the GOT address of libc", "eax == NULL"],
195
- effect: "execl(\"/bin/sh\", eax)")
196
- OneGadget::Gadget.add(build_id, 1257407,
197
- constraints: ["esi is the GOT address of libc", "[esp] == NULL"],
198
- effect: "execl(\"/bin/sh\", [esp])")
199
-