one_gadget 2.0.0 → 2.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (49) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +197 -65
  3. data/README.md +96 -22
  4. data/lib/one_gadget/abi.rb +41 -5
  5. data/lib/one_gadget/builds/libc-2.31-93b46e0027747153e336c3fd9431ce9a5d82ad00.rb +563 -0
  6. data/lib/one_gadget/builds/libc-2.35-891c1403437a4e30e684e0c8e34b87a09e4298e5.rb +434 -0
  7. data/lib/one_gadget/builds/libc-2.39-a1d1cf4badf1f5dfe57ff1d17bd692ccc6fcd5c5.rb +531 -0
  8. data/lib/one_gadget/builds/libc-2.39-cd8f5a207dd67aea370d2b471a54c3e56f44ab18.rb +531 -0
  9. data/lib/one_gadget/builds/libc-2.43-b50ceafbd17dc6bceee344a66671c7eaa152bef4.rb +15 -0
  10. data/lib/one_gadget/emulators/aarch64.rb +5 -2
  11. data/lib/one_gadget/emulators/amd64.rb +1 -0
  12. data/lib/one_gadget/emulators/arm.rb +27 -18
  13. data/lib/one_gadget/emulators/arm_family.rb +35 -160
  14. data/lib/one_gadget/emulators/conditional.rb +28 -22
  15. data/lib/one_gadget/emulators/constraints.rb +269 -0
  16. data/lib/one_gadget/emulators/data_processing.rb +167 -0
  17. data/lib/one_gadget/emulators/i386.rb +4 -6
  18. data/lib/one_gadget/emulators/instruction.rb +24 -1
  19. data/lib/one_gadget/emulators/lambda.rb +3 -1
  20. data/lib/one_gadget/emulators/mips.rb +289 -0
  21. data/lib/one_gadget/emulators/processor.rb +33 -455
  22. data/lib/one_gadget/emulators/register_file.rb +19 -10
  23. data/lib/one_gadget/emulators/riscv64.rb +265 -0
  24. data/lib/one_gadget/emulators/safe_calls.rb +9 -3
  25. data/lib/one_gadget/emulators/tracked_memory.rb +209 -0
  26. data/lib/one_gadget/emulators/x86.rb +32 -22
  27. data/lib/one_gadget/fetchers/aarch64.rb +0 -27
  28. data/lib/one_gadget/fetchers/amd64.rb +0 -24
  29. data/lib/one_gadget/fetchers/argument_resolution.rb +340 -0
  30. data/lib/one_gadget/fetchers/arm.rb +99 -44
  31. data/lib/one_gadget/fetchers/base.rb +142 -640
  32. data/lib/one_gadget/fetchers/candidate_walk.rb +150 -0
  33. data/lib/one_gadget/fetchers/disassembly.rb +252 -0
  34. data/lib/one_gadget/fetchers/dynamic_symbols.rb +104 -0
  35. data/lib/one_gadget/fetchers/i386.rb +5 -8
  36. data/lib/one_gadget/fetchers/mips.rb +478 -0
  37. data/lib/one_gadget/fetchers/objdump.rb +24 -2
  38. data/lib/one_gadget/fetchers/riscv64.rb +78 -0
  39. data/lib/one_gadget/fetchers/x86.rb +19 -0
  40. data/lib/one_gadget/fetchers.rb +22 -6
  41. data/lib/one_gadget/gadget.rb +25 -34
  42. data/lib/one_gadget/helper.rb +19 -5
  43. data/lib/one_gadget/one_gadget.rb +6 -0
  44. data/lib/one_gadget/version.rb +1 -1
  45. data/lib/one_gadget.rb +1 -1
  46. metadata +18 -6
  47. data/lib/one_gadget/builds/libc-2.26-2104f3d4ad5cf68603afbe7ba1a17f5ac99c5988.rb +0 -227
  48. data/lib/one_gadget/builds/libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2.rb +0 -300
  49. data/lib/one_gadget/builds/libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252.rb +0 -199
data/lib/one_gadget/builds/libc-2.31-93b46e0027747153e336c3fd9431ce9a5d82ad00.rb ADDED
@@ -0,0 +1,563 @@
1
+ require 'one_gadget/gadget'
2
+ # http://ports.ubuntu.com/ubuntu-ports/pool/main/g/glibc/libc6_2.31-0ubuntu9.18_riscv64.deb
3
+ #
4
+ # RISC-V
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.31-0ubuntu9.18) stable release version 2.31.
7
+ # Copyright (C) 2020 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 9.4.0.
12
+ # libc ABIs: UNIQUE ABSOLUTE
13
+ # For bug reporting instructions, please see:
14
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
15
+
16
+ build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 234878,
18
+ constraints: ["[s1+0x8] != 0x1", "[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "s0 == sp+0x158", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
19
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
20
+ OneGadget::Gadget.add(build_id, 234878,
21
+ constraints: ["[s1+0x8] == 0x1", "[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "s0 == sp+0x158", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
22
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
23
+ OneGadget::Gadget.add(build_id, 234878,
24
+ constraints: ["[s1+0x8] != 0x1", "[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "s0 == sp+0x158", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
25
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
26
+ OneGadget::Gadget.add(build_id, 234878,
27
+ constraints: ["[s1+0x8] == 0x1", "[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "s0 == sp+0x158", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
28
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
29
+ OneGadget::Gadget.add(build_id, 234880,
30
+ constraints: ["[s1+0x8] != 0x1", "[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "s0 == a5", "writable: a5", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
31
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
32
+ OneGadget::Gadget.add(build_id, 234880,
33
+ constraints: ["[s1+0x8] == 0x1", "[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "s0 == a5", "writable: a5", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
34
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
35
+ OneGadget::Gadget.add(build_id, 234880,
36
+ constraints: ["[s1+0x8] != 0x1", "[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "s0 == a5", "writable: a5", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
37
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
38
+ OneGadget::Gadget.add(build_id, 234880,
39
+ constraints: ["[s1+0x8] == 0x1", "[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "s0 == a5", "writable: a5", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
40
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
41
+ OneGadget::Gadget.add(build_id, 234884,
42
+ constraints: ["[s1+0x8] != 0x1", "[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "s0 == a5", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
43
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
44
+ OneGadget::Gadget.add(build_id, 234884,
45
+ constraints: ["[s1+0x8] == 0x1", "[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "s0 == a5", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
46
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
47
+ OneGadget::Gadget.add(build_id, 234884,
48
+ constraints: ["[s1+0x8] != 0x1", "[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "s0 == a5", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
49
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
50
+ OneGadget::Gadget.add(build_id, 234884,
51
+ constraints: ["[s1+0x8] == 0x1", "[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "s0 == a5", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
52
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
53
+ OneGadget::Gadget.add(build_id, 234886,
54
+ constraints: ["[s1+0x8] != 0x1", "[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "s0 == a4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
55
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
56
+ OneGadget::Gadget.add(build_id, 234886,
57
+ constraints: ["[s1+0x8] == 0x1", "[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "s0 == a4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
58
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
59
+ OneGadget::Gadget.add(build_id, 234886,
60
+ constraints: ["[s1+0x8] != 0x1", "[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "s0 == a4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
61
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
62
+ OneGadget::Gadget.add(build_id, 234886,
63
+ constraints: ["[s1+0x8] == 0x1", "[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "s0 == a4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
64
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
65
+ OneGadget::Gadget.add(build_id, 234888,
66
+ constraints: ["[s1+0x8] != 0x1", "[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "s0 == a4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
67
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
68
+ OneGadget::Gadget.add(build_id, 234888,
69
+ constraints: ["[s1+0x8] == 0x1", "[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "s0 == a4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
70
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
71
+ OneGadget::Gadget.add(build_id, 234888,
72
+ constraints: ["[s1+0x8] != 0x1", "[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "s0 == a4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
73
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
74
+ OneGadget::Gadget.add(build_id, 234888,
75
+ constraints: ["[s1+0x8] == 0x1", "[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "s0 == a4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
76
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
77
+ OneGadget::Gadget.add(build_id, 234892,
78
+ constraints: ["[s1+0x8] != 0x1", "[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
79
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
80
+ OneGadget::Gadget.add(build_id, 234892,
81
+ constraints: ["[s1+0x8] == 0x1", "[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
82
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
83
+ OneGadget::Gadget.add(build_id, 234892,
84
+ constraints: ["[s1+0x8] != 0x1", "[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
85
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
86
+ OneGadget::Gadget.add(build_id, 234892,
87
+ constraints: ["[s1+0x8] == 0x1", "[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
88
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
89
+ OneGadget::Gadget.add(build_id, 234894,
90
+ constraints: ["[s1+0xa0] != 0x1", "a4 != 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
91
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
92
+ OneGadget::Gadget.add(build_id, 234894,
93
+ constraints: ["[s1+0xa0] != 0x1", "a4 == 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
94
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
95
+ OneGadget::Gadget.add(build_id, 234894,
96
+ constraints: ["[s1+0xa0] == 0x1", "a4 != 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
97
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
98
+ OneGadget::Gadget.add(build_id, 234894,
99
+ constraints: ["[s1+0xa0] == 0x1", "a4 == 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
100
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
101
+ OneGadget::Gadget.add(build_id, 234896,
102
+ constraints: ["[s1+0xa0] != 0x1", "a4 != a5", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
103
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
104
+ OneGadget::Gadget.add(build_id, 234896,
105
+ constraints: ["[s1+0xa0] != 0x1", "a4 == a5", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
106
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
107
+ OneGadget::Gadget.add(build_id, 234896,
108
+ constraints: ["[s1+0xa0] == 0x1", "a4 != a5", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
109
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
110
+ OneGadget::Gadget.add(build_id, 234896,
111
+ constraints: ["[s1+0xa0] == 0x1", "a4 == a5", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
112
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
113
+ OneGadget::Gadget.add(build_id, 234900,
114
+ constraints: ["[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
115
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
116
+ OneGadget::Gadget.add(build_id, 234900,
117
+ constraints: ["[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
118
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
119
+ OneGadget::Gadget.add(build_id, 234902,
120
+ constraints: ["[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
121
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
122
+ OneGadget::Gadget.add(build_id, 234902,
123
+ constraints: ["[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
124
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
125
+ OneGadget::Gadget.add(build_id, 234906,
126
+ constraints: ["[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
127
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
128
+ OneGadget::Gadget.add(build_id, 234906,
129
+ constraints: ["[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
130
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
131
+ OneGadget::Gadget.add(build_id, 234908,
132
+ constraints: ["[s1+0xa0] != 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
133
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
134
+ OneGadget::Gadget.add(build_id, 234908,
135
+ constraints: ["[s1+0xa0] == 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
136
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
137
+ OneGadget::Gadget.add(build_id, 234910,
138
+ constraints: ["a4 != 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
139
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
140
+ OneGadget::Gadget.add(build_id, 234910,
141
+ constraints: ["a4 == 0x1", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
142
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
143
+ OneGadget::Gadget.add(build_id, 234912,
144
+ constraints: ["a4 != a5", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
145
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
146
+ OneGadget::Gadget.add(build_id, 234912,
147
+ constraints: ["a4 == a5", "readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
148
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
149
+ OneGadget::Gadget.add(build_id, 234916,
150
+ constraints: ["readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
151
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
152
+ OneGadget::Gadget.add(build_id, 234918,
153
+ constraints: ["readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
154
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
155
+ OneGadget::Gadget.add(build_id, 234922,
156
+ constraints: ["readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
157
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
158
+ OneGadget::Gadget.add(build_id, 234924,
159
+ constraints: ["readable: s0", "readable: s4", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
160
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
161
+ OneGadget::Gadget.add(build_id, 234928,
162
+ constraints: ["readable: s0", "readable: s4", "writable: s3", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "(u16)[s3] == 0x0"],
163
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, environ)")
164
+ OneGadget::Gadget.add(build_id, 234930,
165
+ constraints: ["readable: s0", "readable: s4", "writable: a0", "writable: s3", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "(u16)[s3] == 0x0"],
166
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, environ)")
167
+ OneGadget::Gadget.add(build_id, 234934,
168
+ constraints: ["readable: s0", "readable: s4", "writable: s3", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "(u16)[s3] == 0x0"],
169
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, environ)")
170
+ OneGadget::Gadget.add(build_id, 234936,
171
+ constraints: ["readable: a1", "readable: s0", "writable: s3", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "(u16)[s3] == 0x0"],
172
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, environ)")
173
+ OneGadget::Gadget.add(build_id, 234938,
174
+ constraints: ["readable: a1", "readable: s0", "writable: a0", "writable: s3", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "(u16)[s3] == 0x0"],
175
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, environ)")
176
+ OneGadget::Gadget.add(build_id, 234942,
177
+ constraints: ["readable: s0", "writable: s3", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "(u16)[s3] == 0x0"],
178
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, environ)")
179
+ OneGadget::Gadget.add(build_id, 234944,
180
+ constraints: ["readable: a1", "writable: s3", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "(u16)[s3] == 0x0"],
181
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, environ)")
182
+ OneGadget::Gadget.add(build_id, 234946,
183
+ constraints: ["readable: a1", "writable: a0", "writable: s3", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "(u16)[s3] == 0x0"],
184
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, environ)")
185
+ OneGadget::Gadget.add(build_id, 234950,
186
+ constraints: ["writable: s3", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "(u16)[s3] == 0x0"],
187
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, environ)")
188
+ OneGadget::Gadget.add(build_id, 234952,
189
+ constraints: ["writable: s3", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "(u16)[s3] == 0x0"],
190
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, environ)")
191
+ OneGadget::Gadget.add(build_id, 234954,
192
+ constraints: ["writable: a0", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "s3 == NULL || (u16)[s3] == 0x0"],
193
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, environ)")
194
+ OneGadget::Gadget.add(build_id, 234958,
195
+ constraints: ["{\"sh\", \"-c\", s5, NULL} is a valid argv", "s3 == NULL || (u16)[s3] == 0x0"],
196
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, environ)")
197
+ OneGadget::Gadget.add(build_id, 234966,
198
+ constraints: ["readable: a5", "{\"sh\", \"-c\", s5, NULL} is a valid argv", "[[a5]] == NULL || [a5] == NULL || [a5] is a valid envp", "s3 == NULL || (u16)[s3] == 0x0"],
199
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, [a5])")
200
+ OneGadget::Gadget.add(build_id, 234968,
201
+ constraints: ["{\"sh\", \"-c\", s5, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s3 == NULL || (u16)[s3] == 0x0"],
202
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, a5)")
203
+ OneGadget::Gadget.add(build_id, 234972,
204
+ constraints: ["a6+0x6b0 == NULL || {a6+0x6b0, \"-c\", s5, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s3 == NULL || (u16)[s3] == 0x0"],
205
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, a5)")
206
+ OneGadget::Gadget.add(build_id, 234976,
207
+ constraints: ["a6 == NULL || {a6, \"-c\", s5, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s3 == NULL || (u16)[s3] == 0x0"],
208
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, a5)")
209
+ OneGadget::Gadget.add(build_id, 234978,
210
+ constraints: ["[sp+0x40] == NULL || {[sp+0x40], \"-c\", s5, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s3 == NULL || (u16)[s3] == 0x0"],
211
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, sp+0x40, a5)")
212
+ OneGadget::Gadget.add(build_id, 234980,
213
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s3 == NULL || (u16)[s3] == 0x0"],
214
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, a4, a5)")
215
+ OneGadget::Gadget.add(build_id, 234984,
216
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s3 == NULL || (u16)[s3] == 0x0"],
217
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, a4, a5)")
218
+ OneGadget::Gadget.add(build_id, 234988,
219
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s3 == NULL || (u16)[s3] == 0x0"],
220
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s3, a4, a5)")
221
+ OneGadget::Gadget.add(build_id, 234990,
222
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "a3 == NULL || (u16)[a3] == 0x0"],
223
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, a3, a4, a5)")
224
+ OneGadget::Gadget.add(build_id, 234992,
225
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "a2 == NULL || (s32)[a2+0x4] <= 0x0", "a3 == NULL || (u16)[a3] == 0x0"],
226
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", a2, a3, a4, a5)")
227
+ OneGadget::Gadget.add(build_id, 352156,
228
+ constraints: ["s1 == 0x0", "writable: s6+0xc", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
229
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
230
+ OneGadget::Gadget.add(build_id, 352160,
231
+ constraints: ["s1 == 0x0", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
232
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
233
+ OneGadget::Gadget.add(build_id, 352164,
234
+ constraints: ["[s1+0xe8] == 0x0", "s2 == a1", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
235
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
236
+ OneGadget::Gadget.add(build_id, 352174,
237
+ constraints: ["[s1+0xe8] == 0x0", "a0 == 0x0", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
238
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
239
+ OneGadget::Gadget.add(build_id, 352178,
240
+ constraints: ["[s1+0xe8] == 0x0", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
241
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
242
+ OneGadget::Gadget.add(build_id, 352180,
243
+ constraints: ["s1 == 0x0", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
244
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
245
+ OneGadget::Gadget.add(build_id, 352182,
246
+ constraints: ["{\"sh\", \"-c\", s3, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
247
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
248
+ OneGadget::Gadget.add(build_id, 352190,
249
+ constraints: ["readable: a5", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "[[a5]] == NULL || [a5] == NULL || [a5] is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
250
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, [a5])")
251
+ OneGadget::Gadget.add(build_id, 352192,
252
+ constraints: ["{\"sh\", \"-c\", s3, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
253
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, a5)")
254
+ OneGadget::Gadget.add(build_id, 352196,
255
+ constraints: ["a6-0x338 == NULL || {a6-0x338, \"-c\", s3, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
256
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, a5)")
257
+ OneGadget::Gadget.add(build_id, 352200,
258
+ constraints: ["a6 == NULL || {a6, \"-c\", s3, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
259
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, a5)")
260
+ OneGadget::Gadget.add(build_id, 352202,
261
+ constraints: ["[sp+0x38] == NULL || {[sp+0x38], \"-c\", s3, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
262
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, a5)")
263
+ OneGadget::Gadget.add(build_id, 352204,
264
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
265
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, a4, a5)")
266
+ OneGadget::Gadget.add(build_id, 352208,
267
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
268
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, a4, a5)")
269
+ OneGadget::Gadget.add(build_id, 352212,
270
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
271
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, a4, a5)")
272
+ OneGadget::Gadget.add(build_id, 352214,
273
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0", "a3 == NULL || (u16)[a3] == 0x0"],
274
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, a3, a4, a5)")
275
+ OneGadget::Gadget.add(build_id, 352216,
276
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "a2 == NULL || (s32)[a2+0x4] <= 0x0", "a3 == NULL || (u16)[a3] == 0x0"],
277
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", a2, a3, a4, a5)")
278
+ OneGadget::Gadget.add(build_id, 541154,
279
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
280
+ effect: "execve(\"/bin/sh\", sp-0x50, a2)")
281
+ OneGadget::Gadget.add(build_id, 541154,
282
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
283
+ effect: "execve(\"/bin/sh\", sp-0x70, a2)")
284
+ OneGadget::Gadget.add(build_id, 541156,
285
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
286
+ effect: "execve(\"/bin/sh\", sp, a2)")
287
+ OneGadget::Gadget.add(build_id, 541156,
288
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
289
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
290
+ OneGadget::Gadget.add(build_id, 541158,
291
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
292
+ effect: "execve(\"/bin/sh\", sp, a2)")
293
+ OneGadget::Gadget.add(build_id, 541158,
294
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
295
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
296
+ OneGadget::Gadget.add(build_id, 541160,
297
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
298
+ effect: "execve(\"/bin/sh\", sp, a2)")
299
+ OneGadget::Gadget.add(build_id, 541160,
300
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
301
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
302
+ OneGadget::Gadget.add(build_id, 541162,
303
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
304
+ effect: "execve(\"/bin/sh\", sp, a2)")
305
+ OneGadget::Gadget.add(build_id, 541162,
306
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
307
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
308
+ OneGadget::Gadget.add(build_id, 541164,
309
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
310
+ effect: "execve(\"/bin/sh\", sp, a2)")
311
+ OneGadget::Gadget.add(build_id, 541164,
312
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
313
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
314
+ OneGadget::Gadget.add(build_id, 541166,
315
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
316
+ effect: "execve(\"/bin/sh\", sp, a2)")
317
+ OneGadget::Gadget.add(build_id, 541166,
318
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
319
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
320
+ OneGadget::Gadget.add(build_id, 541168,
321
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
322
+ effect: "execve(\"/bin/sh\", sp, a2)")
323
+ OneGadget::Gadget.add(build_id, 541168,
324
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
325
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
326
+ OneGadget::Gadget.add(build_id, 541170,
327
+ constraints: ["[a1] == 0x0", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
328
+ effect: "execve(\"/bin/sh\", s0-0x50, a2)")
329
+ OneGadget::Gadget.add(build_id, 541170,
330
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "writable: s0-0x38", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
331
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
332
+ OneGadget::Gadget.add(build_id, 541174,
333
+ constraints: ["[a1] == 0x0", "readable: [s3+0x4ce]", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
334
+ effect: "execve(\"/bin/sh\", s0-0x50, a2)")
335
+ OneGadget::Gadget.add(build_id, 541174,
336
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "readable: [s3+0x4ce]", "writable: s0-0x38", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
337
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
338
+ OneGadget::Gadget.add(build_id, 541178,
339
+ constraints: ["[a1] == 0x0", "readable: s3", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
340
+ effect: "execve(\"/bin/sh\", s0-0x50, a2)")
341
+ OneGadget::Gadget.add(build_id, 541178,
342
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "readable: s3", "writable: s0-0x38", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
343
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
344
+ OneGadget::Gadget.add(build_id, 541182,
345
+ constraints: ["[a1] == 0x0", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
346
+ effect: "execve(\"/bin/sh\", s0-0x50, a2)")
347
+ OneGadget::Gadget.add(build_id, 541182,
348
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "writable: s0-0x38", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
349
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
350
+ OneGadget::Gadget.add(build_id, 541184,
351
+ constraints: ["a3 == 0x0", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
352
+ effect: "execve(\"/bin/sh\", s0-0x50, a2)")
353
+ OneGadget::Gadget.add(build_id, 541184,
354
+ constraints: ["[a1+0x8] == 0x0", "a3 != 0x0", "writable: s0-0x38", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
355
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
356
+ OneGadget::Gadget.add(build_id, 541186,
357
+ constraints: ["a3 == 0x0", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
358
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
359
+ OneGadget::Gadget.add(build_id, 541186,
360
+ constraints: ["[a1+0x8] == 0x0", "a3 != 0x0", "writable: s0-0x38", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
361
+ effect: "execve(\"/bin/sh\", sp-0x20, s2)")
362
+ OneGadget::Gadget.add(build_id, 541190,
363
+ constraints: ["[a1+0x8] == 0x0", "a3 != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
364
+ effect: "execve(\"/bin/sh\", sp-0x20, s2)")
365
+ OneGadget::Gadget.add(build_id, 541190,
366
+ constraints: ["a3 == 0x0", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
367
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
368
+ OneGadget::Gadget.add(build_id, 541192,
369
+ constraints: ["[a1+0x8] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
370
+ effect: "execve(\"/bin/sh\", sp-0x20, s2)")
371
+ OneGadget::Gadget.add(build_id, 541194,
372
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
373
+ effect: "execve(\"/bin/sh\", sp-0x20, s2)")
374
+ OneGadget::Gadget.add(build_id, 541198,
375
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
376
+ effect: "execve(\"/bin/sh\", sp-0x20, s2)")
377
+ OneGadget::Gadget.add(build_id, 541200,
378
+ constraints: ["[a4] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
379
+ effect: "execve(\"/bin/sh\", sp-0x20, s2)")
380
+ OneGadget::Gadget.add(build_id, 541242,
381
+ constraints: ["a5 == 0x1", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
382
+ effect: "execve(\"/bin/sh\", sp, s2)")
383
+ OneGadget::Gadget.add(build_id, 541244,
384
+ constraints: ["a5 == 0x1", "writable: s1", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
385
+ effect: "execve(\"/bin/sh\", s1, s2)")
386
+ OneGadget::Gadget.add(build_id, 541248,
387
+ constraints: ["a5 == 0x1", "writable: s1", "a4-0x5a4 == NULL || {a4-0x5a4, a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
388
+ effect: "execve(\"/bin/sh\", s1, s2)")
389
+ OneGadget::Gadget.add(build_id, 541252,
390
+ constraints: ["a5 == 0x1", "writable: s1", "a4 == NULL || {a4, a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
391
+ effect: "execve(\"/bin/sh\", s1, s2)")
392
+ OneGadget::Gadget.add(build_id, 541254,
393
+ constraints: ["a5 == 0x1", "writable: s1+0x8", "[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
394
+ effect: "execve(\"/bin/sh\", s1, s2)")
395
+ OneGadget::Gadget.add(build_id, 541256,
396
+ constraints: ["a5 == 0x1", "writable: s1+0x10", "[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
397
+ effect: "execve(\"/bin/sh\", s1, s2)")
398
+ OneGadget::Gadget.add(build_id, 541258,
399
+ constraints: ["a5 == a4", "writable: s1+0x10", "[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
400
+ effect: "execve(\"/bin/sh\", s1, s2)")
401
+ OneGadget::Gadget.add(build_id, 541262,
402
+ constraints: ["writable: s1+0x10", "[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
403
+ effect: "execve(\"/bin/sh\", s1, s2)")
404
+ OneGadget::Gadget.add(build_id, 541266,
405
+ constraints: ["[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
406
+ effect: "execve(\"/bin/sh\", s1, s2)")
407
+ OneGadget::Gadget.add(build_id, 541268,
408
+ constraints: ["[s1] == NULL || s1 == NULL || s1 is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
409
+ effect: "execve(\"/bin/sh\", s1, a2)")
410
+ OneGadget::Gadget.add(build_id, 541270,
411
+ constraints: ["[a1] == NULL || a1 == NULL || a1 is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
412
+ effect: "execve(\"/bin/sh\", a1, a2)")
413
+ OneGadget::Gadget.add(build_id, 541324,
414
+ constraints: ["[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
415
+ effect: "execve(\"/bin/sh\", s1, s2)")
416
+ OneGadget::Gadget.add(build_id, 541342,
417
+ constraints: ["writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
418
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
419
+ OneGadget::Gadget.add(build_id, 541346,
420
+ constraints: ["writable: s0-0x50", "a5-0x606 == NULL || {a5-0x606, a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
421
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
422
+ OneGadget::Gadget.add(build_id, 541350,
423
+ constraints: ["writable: s0-0x50", "a5 == NULL || {a5, a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
424
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
425
+ OneGadget::Gadget.add(build_id, 541352,
426
+ constraints: ["writable: s0-0x50", "a5 == NULL || {a5, a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
427
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
428
+ OneGadget::Gadget.add(build_id, 541356,
429
+ constraints: ["writable: s0-0x48", "[s0-0x50] == NULL || {[s0-0x50], a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
430
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
431
+ OneGadget::Gadget.add(build_id, 541360,
432
+ constraints: ["writable: s0-0x40", "[s0-0x50] == NULL || {[s0-0x50], [s0-0x48], NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
433
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
434
+ OneGadget::Gadget.add(build_id, 541364,
435
+ constraints: ["writable: s1+0x10", "[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
436
+ effect: "execve(\"/bin/sh\", s1, s2)")
437
+ OneGadget::Gadget.add(build_id, 625022,
438
+ constraints: ["a0 == 0x0", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
439
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, environ)")
440
+ OneGadget::Gadget.add(build_id, 625026,
441
+ constraints: ["[[[$base+0x108620]]] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
442
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
443
+ OneGadget::Gadget.add(build_id, 625030,
444
+ constraints: ["[[[a5-0x362]]] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
445
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
446
+ OneGadget::Gadget.add(build_id, 625034,
447
+ constraints: ["[[a5]] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
448
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
449
+ OneGadget::Gadget.add(build_id, 625038,
450
+ constraints: ["[s11] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
451
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
452
+ OneGadget::Gadget.add(build_id, 625040,
453
+ constraints: ["[s11] == 0x0", "[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
454
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
455
+ OneGadget::Gadget.add(build_id, 625044,
456
+ constraints: ["[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "s6 == 0x0", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
457
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
458
+ OneGadget::Gadget.add(build_id, 625060,
459
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
460
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
461
+ OneGadget::Gadget.add(build_id, 625064,
462
+ constraints: ["[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "s6 == 0x0", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
463
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
464
+ OneGadget::Gadget.add(build_id, 625066,
465
+ constraints: ["[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "s6 == 0x0", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
466
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
467
+ OneGadget::Gadget.add(build_id, 625092,
468
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd8] != -0x1", "a3+0x1 != [sp+0xd8]", "writable: ((a3 << 0x3) + [sp+0xe0])", "writable: ((a3+0x1 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "s6 == NULL || readable: s6", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
469
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
470
+ OneGadget::Gadget.add(build_id, 625096,
471
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd8] != -0x1", "a2 != [sp+0xd8]", "writable: ((a2 << 0x3) + [sp+0xe0])", "writable: ((a3 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "s6 == NULL || readable: s6", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
472
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
473
+ OneGadget::Gadget.add(build_id, 625098,
474
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "writable: ((a3 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "s6 == NULL || readable: s6", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
475
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
476
+ OneGadget::Gadget.add(build_id, 625100,
477
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "writable: ((a3 << 0x3) + a2)", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
478
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
479
+ OneGadget::Gadget.add(build_id, 625102,
480
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "writable: (a3 + a2)", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
481
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
482
+ OneGadget::Gadget.add(build_id, 625104,
483
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "writable: a3", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
484
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
485
+ OneGadget::Gadget.add(build_id, 625108,
486
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
487
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
488
+ OneGadget::Gadget.add(build_id, 625110,
489
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
490
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
491
+ OneGadget::Gadget.add(build_id, 625118,
492
+ constraints: ["[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
493
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
494
+ OneGadget::Gadget.add(build_id, 625120,
495
+ constraints: ["[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != a5", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
496
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
497
+ OneGadget::Gadget.add(build_id, 625124,
498
+ constraints: ["[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
499
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
500
+ OneGadget::Gadget.add(build_id, 625126,
501
+ constraints: ["[sp+0xd8] != -0x1", "a5 != s5", "writable: ((a5 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
502
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
503
+ OneGadget::Gadget.add(build_id, 625130,
504
+ constraints: ["[sp+0xd8] != -0x1", "writable: ((a5 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
505
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
506
+ OneGadget::Gadget.add(build_id, 625134,
507
+ constraints: ["[sp+0xd8] != -0x1", "writable: ((a5 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
508
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
509
+ OneGadget::Gadget.add(build_id, 625136,
510
+ constraints: ["[sp+0xd8] != -0x1", "writable: ((a5 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
511
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
512
+ OneGadget::Gadget.add(build_id, 625138,
513
+ constraints: ["[sp+0xd8] != -0x1", "writable: ((a5 << 0x3) + a4)", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
514
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
515
+ OneGadget::Gadget.add(build_id, 625140,
516
+ constraints: ["[sp+0xd8] != -0x1", "writable: (a5 + a4)", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
517
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
518
+ OneGadget::Gadget.add(build_id, 625142,
519
+ constraints: ["[sp+0xd8] != -0x1", "writable: a5", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
520
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
521
+ OneGadget::Gadget.add(build_id, 625146,
522
+ constraints: ["[sp+0xd8] != -0x1", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
523
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
524
+ OneGadget::Gadget.add(build_id, 625148,
525
+ constraints: ["a4 != -0x1", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
526
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
527
+ OneGadget::Gadget.add(build_id, 625150,
528
+ constraints: ["a4 != a5", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
529
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
530
+ OneGadget::Gadget.add(build_id, 625154,
531
+ constraints: ["[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
532
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
533
+ OneGadget::Gadget.add(build_id, 625156,
534
+ constraints: ["[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
535
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, a5)")
536
+ OneGadget::Gadget.add(build_id, 625158,
537
+ constraints: ["[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "a2 == NULL || (s32)[a2+0x4] <= 0x0"],
538
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", a2, 0, sp+0x60, a5)")
539
+ OneGadget::Gadget.add(build_id, 625160,
540
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "a2 == NULL || (s32)[a2+0x4] <= 0x0"],
541
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", a2, 0, a4, a5)")
542
+ OneGadget::Gadget.add(build_id, 625162,
543
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "a2 == NULL || (s32)[a2+0x4] <= 0x0", "a3 == NULL || (u16)[a3] == 0x0"],
544
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", a2, a3, a4, a5)")
545
+ OneGadget::Gadget.add(build_id, 625872,
546
+ constraints: ["[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
547
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, environ)")
548
+ OneGadget::Gadget.add(build_id, 625880,
549
+ constraints: ["readable: a5", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[a5]] == NULL || [a5] == NULL || [a5] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
550
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [a5])")
551
+ OneGadget::Gadget.add(build_id, 625882,
552
+ constraints: ["[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
553
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, a5)")
554
+ OneGadget::Gadget.add(build_id, 625892,
555
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
556
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
557
+ OneGadget::Gadget.add(build_id, 625894,
558
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
559
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
560
+ OneGadget::Gadget.add(build_id, 625918,
561
+ constraints: ["[sp+0xd8] != -0x1", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
562
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
563
+