one_gadget 2.0.0 → 2.1.1

data/lib/one_gadget/gadget.rb

@@ -10,6 +10,23 @@ module OneGadget
   # Module for define gadgets.
   module Gadget
     # Information of a gadget.
+    #
+    # Its {Gadget#constraints} are written in this language:
+    #   REG: OneGadget::ABI.all
+    #   IMM: [+-]0x[\da-f]+
+    #   BITS: 8, 16, 32, 64
+    #   CAST: (<s|u><BITS>)
+    #   Identity: <REG><IMM>?
+    #   Identity: [<Identity>]
+    #   Expr: <REG> is the GOT address of libc
+    #   Expr: writable: <Identity>
+    #   Expr: readable: <Identity>
+    #   Expr: <CAST>?<Identity> == NULL
+    #   Expr: <REG> & 0xf == <IMM>
+    #   Expr: (s32)[<Identity>] <= 0
+    #   Expr: .+ is a valid argv
+    #   Expr: .+ is a valid envp
+    #   Expr: <Expr> || <Expr>
     class Gadget
       # @return [Integer] Base address of libc. Default: 0.
       attr_accessor :base
@@ -138,22 +155,9 @@ module OneGadget
       private
 
       # Drops what the rest of the list already settles, so a gadget asks for each
-      # thing once and never offers an option it rules out itself.
-      #
-      # Most of it follows from one reading: a constraint that accesses an address
-      # says that address is mapped memory (see {#mapped?}), which in turn says it
-      # is readable and not NULL. So:
-      # * A +readable:+ on an address a dereference already reaches repeats it.
-      # * A +== NULL+ option for a mapped address can never be taken.
-      # * A +!= NULL+ requirement on one is already met.
-      # The last rule reads a value rather than an address: one the list pins to a
-      # literal answers every other comparison against it, so a bound that literal
-      # already satisfies asks for nothing.
-      #
-      # Each needs the constraint doing the settling to hold outright: one inside a
-      # +||+ is an option among several and settles nothing. They run until the
-      # list stops changing, because dropping an option can leave a constraint
-      # holding outright and settle the next thing.
+      # thing once and never offers an option it rules out itself. Only a
+      # constraint holding outright settles anything, since one inside a +||+ is an
+      # option among several; the rules run until the list stops changing.
       # @param [Array<String>] cons
       # @return [Array<String>]
       # @example An option the same list rules out.
@@ -305,29 +309,14 @@ module OneGadget
         end
       end
 
-      # REG: OneGadget::ABI.all
-      # IMM: [+-]0x[\da-f]+
-      # BITS: 8, 16, 32, 64
-      # CAST: (<s|u><BITS>)
-      # Identity: <REG><IMM>?
-      # Identity: [<Identity>]
-      # Expr: <REG> is the GOT address of libc
-      # Expr: writable: <Identity>
-      # Expr: readable: <Identity>
-      # Expr: <CAST>?<Identity> == NULL
-      # Expr: <REG> & 0xf == <IMM>
-      # Expr: (s32)[<Identity>] <= 0
-      # Expr: .+ is a valid argv
-      # Expr: .+ is a valid envp
-      # Expr: <Expr> || <Expr>
       def calculate_score(expr)
         return expr.split(' || ').map(&method(:calculate_score)).max if expr.include?(' || ')
 
         return 0.95 if stack_alignment?(expr)
         # Zero is the easy value to arrange and every other one is hard, so a mask
-        # tells them apart rather than making them easier: asking for zero in some
-        # of a value's bits is a little easier than zeroing all of it, while asking
-        # a mask for any other value is as hard as asking for that value anywhere.
+        # tells them apart rather than making them easier: some of a value's bits
+        # zeroed is a little easier than all of them, while a mask asking for any
+        # other value is as hard as asking for it anywhere.
         return 0.92 if MASKED_ZERO.match?(expr)
         # Any other mask asks for a particular value, which the mask does nothing
         # to make easier, so it is the relation it looks like.
@@ -424,6 +413,8 @@ module OneGadget
         0.9**(depth + base)
       end
 
+      # The constraints as a reader wants them: every +writable:+ folded into one
+      # sentence naming all of the addresses, the rest left alone.
       def merge_constraints
         key = 'writable: '
         w_cons, normal = constraints.partition { |c| c.start_with?(key) }
@@ -455,8 +446,7 @@ module OneGadget
         table = OneGadget::Helper.remote_builds.find { |c| c.include?(build_id) }
         return build_not_found if table.nil? # remote doesn't have this one either.
 
-        # builds found in remote! Ask update gem and download remote gadgets.
-        OneGadget::Logger.ask_update(msg: 'The desired one-gadget can be found in lastest version!')
+        OneGadget::Logger.info("#{build_id} is not shipped with the gem, fetching it from the repository\n")
         tmp_file = OneGadget::Helper.download_build(table)
         require tmp_file.path
         tmp_file.unlink
@@ -466,7 +456,7 @@ module OneGadget
       # Returns the comments in builds/libc-*-<build_id>*.rb
       # @param [String] build_id
       #   Supports give only few starting bytes, but a warning will be shown
-      #   if multiple BulidIDs are matched.
+      #   if multiple BuildIDs are matched.
       # @return [String?]
       #   Lines of comments.
       # @example

data/lib/one_gadget/helper.rb

@@ -190,7 +190,6 @@ module OneGadget
       nil
     end
 
-    # Fetch the ELF architecture of +file+.
     # What this tool calls each architecture it can search. Keyed by the
     # header's own value, which is fixed by the ELF ABI, rather than by the name a
     # reader library prints for it -- that is the library's wording and does
@@ -199,9 +198,12 @@ module OneGadget
       ELFTools::Constants::EM::EM_386 => :i386,
       ELFTools::Constants::EM::EM_ARM => :arm,
       ELFTools::Constants::EM::EM_X86_64 => :amd64,
-      ELFTools::Constants::EM::EM_AARCH64 => :aarch64
+      ELFTools::Constants::EM::EM_AARCH64 => :aarch64,
+      ELFTools::Constants::EM::EM_RISCV => :riscv64,
+      ELFTools::Constants::EM::EM_MIPS => :mips
     }.freeze
 
+    # Fetch the ELF architecture of +file+.
     # @param [String] file The target ELF filename.
     # @return [Symbol]
     #   One of +:amd64+, +:i386+, +:arm+ or +:aarch64+, +:unknown+ for a valid ELF
@@ -302,8 +304,18 @@ module OneGadget
     def objdump_arch_supported?(bin, arch)
       return false if bin.nil?
 
-      arch = objdump_arch(arch)
-      `#{::Shellwords.join([bin, '--help'])}`.lines.any? { |c| c.split.include?(arch) }
+      objdump_targets(bin).include?(objdump_arch(arch))
+    end
+
+    # The target names an objdump binary lists as supported. Asked of the binary
+    # once: the answer is a property of that build, while the question is asked
+    # again for every command a search assembles.
+    # @param [String] bin Path to the objdump binary.
+    # @return [Array<String>]
+    # @example Every word of the help text, a target looked for among them.
+    #   objdump_targets('/usr/bin/objdump').include?('elf64-x86-64') #=> true
+    def objdump_targets(bin)
+      (@objdump_targets ||= {})[bin] ||= `#{::Shellwords.join([bin, '--help'])}`.split
     end
 
     # Converts to the architecture name shown in objdump's +--help+ command.
@@ -317,6 +329,7 @@ module OneGadget
     def objdump_arch(arch)
       case arch
       when :amd64 then 'i386:x86-64'
+      when :riscv64 then 'riscv:rv64'
       else arch.to_s
       end
     end
@@ -331,7 +344,8 @@ module OneGadget
         aarch64: 'aarch64-linux-gnu-objdump',
         amd64: 'x86_64-linux-gnu-objdump',
         arm: 'arm-linux-gnueabihf-objdump',
-        i386: 'i686-linux-gnu-objdump'
+        i386: 'i686-linux-gnu-objdump',
+        riscv64: 'riscv64-linux-gnu-objdump'
       }[arch]
     end
 

data/lib/one_gadget/one_gadget.rb

@@ -79,6 +79,12 @@ module OneGadget
       take_until(high, 3)
     end
 
+    # The +count+ best-scoring of +ary+, in the order they were given, plus
+    # anything scoring as well as the last of them -- so a tie is never broken
+    # arbitrarily, and more than +count+ may come back.
+    # @param [Array<OneGadget::Gadget::Gadget>] ary
+    # @param [Integer] count
+    # @return [Array<OneGadget::Gadget::Gadget>]
     def take_until(ary, count)
       return ary if ary.size <= count
 

data/lib/one_gadget/version.rb

@@ -2,5 +2,5 @@
 
 module OneGadget
   # Current gem version.
-  VERSION = '2.0.0'
+  VERSION = '2.1.1'
 end

data/lib/one_gadget.rb

@@ -16,7 +16,7 @@ require 'one_gadget/version'
 # @param [String?] arg
 #   Can be either +build_id+ or path to libc.
 # @param [Mixed] options
-#   See {OneGadget#gadgets} for ore information.
+#   See {OneGadget#gadgets} for more information.
 # @return [Array<OneGadget::Gadget::Gadget>, Array<Integer>]
 #   The gadgets found.
 # @example

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: one_gadget
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.1
 platform: ruby
 authors:
 - david942j
@@ -15,7 +15,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.0
+        version: 2.2.0
     - - "<"
       - !ruby/object:Gem::Version
         version: 3.0.0
@@ -25,7 +25,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.0
+        version: 2.2.0
     - - "<"
       - !ruby/object:Gem::Version
         version: 3.0.0
@@ -139,9 +139,6 @@ files:
 - lib/one_gadget/builds/libc-2.23-991d173c6b9056712812d98507cbe95f937db7cf.rb
 - lib/one_gadget/builds/libc-2.24-8cba3297f538691eb1875be62986993c004f3f4d.rb
 - lib/one_gadget/builds/libc-2.24-fd0655c4d2073eda4235084e1d0e558f0251be8a.rb
-- lib/one_gadget/builds/libc-2.26-2104f3d4ad5cf68603afbe7ba1a17f5ac99c5988.rb
-- lib/one_gadget/builds/libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2.rb
-- lib/one_gadget/builds/libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252.rb
 - lib/one_gadget/builds/libc-2.27-53f40c1d2f3739ae017dcdcef1a17314786e3709.rb
 - lib/one_gadget/builds/libc-2.27-63b3d43ad45e1b0f601848c65b067f9e9b40528b.rb
 - lib/one_gadget/builds/libc-2.27-8c2d375f8d23a7b58de23a60b37bef2d80b23aef.rb
@@ -149,16 +146,20 @@ files:
 - lib/one_gadget/builds/libc-2.31-00537087f0a4c4381deb83f49cc19e6abfd47a12.rb
 - lib/one_gadget/builds/libc-2.31-5792732f783158c66fb4f3756458ca24e46e827d.rb
 - lib/one_gadget/builds/libc-2.31-749e6d13e587d608128a097381cd44b9aca59927.rb
+- lib/one_gadget/builds/libc-2.31-93b46e0027747153e336c3fd9431ce9a5d82ad00.rb
 - lib/one_gadget/builds/libc-2.31-9fdb74e7b217d06c93172a8243f8547f947ee6d1.rb
 - lib/one_gadget/builds/libc-2.31-aa18dedb2aa800a743aac3bb546b8bd5816dbca6.rb
 - lib/one_gadget/builds/libc-2.35-1a0246cddde3e301e0cd5a85630aa26e89cb34b5.rb
 - lib/one_gadget/builds/libc-2.35-22ca0a83a4004122e30a69b597be96e134068616.rb
 - lib/one_gadget/builds/libc-2.35-4a81130bc30ded618f1edc030ecc5439e066dc68.rb
+- lib/one_gadget/builds/libc-2.35-891c1403437a4e30e684e0c8e34b87a09e4298e5.rb
 - lib/one_gadget/builds/libc-2.35-a91d1bc05ce8f54989de1172c24b2b736378901f.rb
 - lib/one_gadget/builds/libc-2.39-328820b908de8ea1ef79afa8995e302e819163d7.rb
 - lib/one_gadget/builds/libc-2.39-54ae5337044aaabab70d65e0c3444f7e4735e059.rb
 - lib/one_gadget/builds/libc-2.39-70d6616bcfd43eaa73962220df98dd9c82ca6687.rb
+- lib/one_gadget/builds/libc-2.39-a1d1cf4badf1f5dfe57ff1d17bd692ccc6fcd5c5.rb
 - lib/one_gadget/builds/libc-2.39-a7e93008cd7dad7a713e3eaf1f9dec78ce7c68a6.rb
+- lib/one_gadget/builds/libc-2.39-cd8f5a207dd67aea370d2b471a54c3e56f44ab18.rb
 - lib/one_gadget/builds/libc-2.39-f5b510cd91b956148e885994f55a0e476462bf92.rb
 - lib/one_gadget/builds/libc-2.43-7a08e84aa7f1e0bd80a7da6227c3a006c3ff327d.rb
 - lib/one_gadget/builds/libc-2.43-8c7af7f227b3871d6afba752cbb617f317023de5.rb
@@ -170,21 +171,32 @@ files:
 - lib/one_gadget/emulators/arm.rb
 - lib/one_gadget/emulators/arm_family.rb
 - lib/one_gadget/emulators/conditional.rb
+- lib/one_gadget/emulators/constraints.rb
+- lib/one_gadget/emulators/data_processing.rb
 - lib/one_gadget/emulators/i386.rb
 - lib/one_gadget/emulators/instruction.rb
 - lib/one_gadget/emulators/lambda.rb
+- lib/one_gadget/emulators/mips.rb
 - lib/one_gadget/emulators/processor.rb
 - lib/one_gadget/emulators/register_file.rb
+- lib/one_gadget/emulators/riscv64.rb
 - lib/one_gadget/emulators/safe_calls.rb
+- lib/one_gadget/emulators/tracked_memory.rb
 - lib/one_gadget/emulators/x86.rb
 - lib/one_gadget/error.rb
 - lib/one_gadget/fetchers.rb
 - lib/one_gadget/fetchers/aarch64.rb
 - lib/one_gadget/fetchers/amd64.rb
+- lib/one_gadget/fetchers/argument_resolution.rb
 - lib/one_gadget/fetchers/arm.rb
 - lib/one_gadget/fetchers/base.rb
+- lib/one_gadget/fetchers/candidate_walk.rb
+- lib/one_gadget/fetchers/disassembly.rb
+- lib/one_gadget/fetchers/dynamic_symbols.rb
 - lib/one_gadget/fetchers/i386.rb
+- lib/one_gadget/fetchers/mips.rb
 - lib/one_gadget/fetchers/objdump.rb
+- lib/one_gadget/fetchers/riscv64.rb
 - lib/one_gadget/fetchers/x86.rb
 - lib/one_gadget/gadget.rb
 - lib/one_gadget/helper.rb

data/lib/one_gadget/builds/libc-2.26-2104f3d4ad5cf68603afbe7ba1a17f5ac99c5988.rb

@@ -1,227 +0,0 @@
-require 'one_gadget/gadget'
-# spec/data/libc-2.26-2104f3d4ad5cf68603afbe7ba1a17f5ac99c5988.so
-# 
-# Advanced Micro Devices X86-64 processor
-# 
-# GNU C Library (GNU libc) stable release version 2.26, by Roland McGrath et al.
-# Copyright (C) 2017 Free Software Foundation, Inc.
-# This is free software; see the source for copying conditions.
-# There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
-# PARTICULAR PURPOSE.
-# Compiled by GNU CC version 7.2.0.
-# Available extensions:
-# 	crypt add-on version 2.1 by Michael Glad and others
-# 	GNU Libidn by Simon Josefsson
-# 	Native POSIX Threads Library by Ulrich Drepper et al
-# 	BIND-8.2.3-T5B
-# libc ABIs: UNIQUE IFUNC
-# For bug reporting instructions, please see:
-# <https://bugs.archlinux.org/>.
-
-build_id = File.basename(__FILE__, '.rb').split('-').last
-OneGadget::Gadget.add(build_id, 269312,
-                      constraints: ["(u64)rax <= 0xfffffffffffff000", "eax == 0x0", "rbx == NULL", "{\"sh\", \"-c\", r12, NULL} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 269324,
-                      constraints: ["eax == 0x0", "rbx == NULL", "{\"sh\", \"-c\", r12, NULL} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 269963,
-                      constraints: ["rbx == NULL", "{\"sh\", \"-c\", r12, NULL} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 269970,
-                      constraints: ["rbx == NULL", "rax == NULL || {rax, \"-c\", r12, NULL} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 269977,
-                      constraints: ["rbx == NULL", "rsi == NULL", "rax == NULL || {rax, \"-c\", r12, NULL} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 269979,
-                      constraints: ["rbx == NULL", "rdx == NULL", "rsi == NULL", "rax == NULL || {rax, \"-c\", r12, NULL} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 269984,
-                      constraints: ["rbx == NULL", "rdx == NULL", "rsi == NULL", "rax == NULL || {rax, \"-c\", r12, NULL} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 269989,
-                      constraints: ["rbx == NULL", "rdx == NULL", "rsi == NULL", "rax == NULL || {rax, \"-c\", [rsp+0x40], NULL} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 269998,
-                      constraints: ["rbx == NULL", "rdx == NULL", "rsi == NULL", "rax == NULL || {rax, \"-c\", [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 270003,
-                      constraints: ["rbx == NULL", "rdx == NULL", "rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], \"-c\", [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 270010,
-                      constraints: ["rbx == NULL", "rdx == NULL", "rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], rax, [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 270015,
-                      constraints: ["rbx == NULL", "rdx == NULL", "rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 270020,
-                      constraints: ["rbx == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 270027,
-                      constraints: ["rbx == NULL", "rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 270029,
-                      constraints: ["rbx == NULL", "rdx == NULL", "rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 270034,
-                      constraints: ["rbx == NULL", "rdx == NULL", "rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 270039,
-                      constraints: ["rbx == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 270041,
-                      constraints: ["rbx == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 270044,
-                      constraints: ["rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 270049,
-                      constraints: ["rsi == NULL", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 270055,
-                      constraints: ["[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, environ)")
-OneGadget::Gadget.add(build_id, 270062,
-                      constraints: ["readable: rax", "[rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv", "[[rax]] == NULL || [rax] == NULL || [rax] is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rsp+0x30, [rax])")
-OneGadget::Gadget.add(build_id, 805713,
-                      constraints: ["[rsi] == 0x0", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[rdx] == NULL || rdx == NULL || rdx is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rsp-0x48, rdx)")
-OneGadget::Gadget.add(build_id, 805723,
-                      constraints: ["[rsi] == 0x0", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[rdx] == NULL || rdx == NULL || rdx is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rsp-0x48, rdx)")
-OneGadget::Gadget.add(build_id, 805728,
-                      constraints: ["[rsi] == 0x0", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[rdx] == NULL || rdx == NULL || rdx is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rsp-0x48, rdx)")
-OneGadget::Gadget.add(build_id, 805729,
-                      constraints: ["[rsi] == 0x0", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[rdx] == NULL || rdx == NULL || rdx is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rsp-0x40, rdx)")
-OneGadget::Gadget.add(build_id, 805731,
-                      constraints: ["[rsi] == 0x0", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[rdx] == NULL || rdx == NULL || rdx is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rsp-0x40, rdx)")
-OneGadget::Gadget.add(build_id, 805734,
-                      constraints: ["[rsi] == 0x0", "writable: rbp-0x40", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[rdx] == NULL || rdx == NULL || rdx is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rbp-0x40, rdx)")
-OneGadget::Gadget.add(build_id, 805736,
-                      constraints: ["[rsi] == 0x0", "writable: rbp-0x40", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[rdx] == NULL || rdx == NULL || rdx is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rbp-0x40, rdx)")
-OneGadget::Gadget.add(build_id, 805738,
-                      constraints: ["[rsi] == 0x0", "writable: rbp-0x40", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[rdx] == NULL || rdx == NULL || rdx is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rbp-0x40, rdx)")
-OneGadget::Gadget.add(build_id, 805739,
-                      constraints: ["[rsi] == 0x0", "writable: rbp-0x40", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[rdx] == NULL || rdx == NULL || rdx is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rbp-0x40, rdx)")
-OneGadget::Gadget.add(build_id, 805742,
-                      constraints: ["[rsi] == 0x0", "writable: rbp-0x40", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rbp-0x40, r12)")
-OneGadget::Gadget.add(build_id, 805746,
-                      constraints: ["[rsi] == 0x0", "writable: rbp-0x40", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rbp-0x40, r12)")
-OneGadget::Gadget.add(build_id, 805755,
-                      constraints: ["[rsi] == 0x0", "writable: rbp-0x40", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rbp-0x40, r12)")
-OneGadget::Gadget.add(build_id, 805759,
-                      constraints: ["[rsi] == 0x0", "writable: rbp-0x40", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rbp-0x40, r12)")
-OneGadget::Gadget.add(build_id, 805761,
-                      constraints: ["[rsi] == 0x0", "writable: rbp-0x40", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rbp-0x40, r12)")
-OneGadget::Gadget.add(build_id, 805767,
-                      constraints: ["writable: rbp-0x40", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rbp-0x40, r12)")
-OneGadget::Gadget.add(build_id, 805888,
-                      constraints: ["[r13] == NULL || r13 == NULL || r13 is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", r13, r12)")
-OneGadget::Gadget.add(build_id, 805891,
-                      constraints: ["[r13] == NULL || r13 == NULL || r13 is a valid argv", "[rdx] == NULL || rdx == NULL || rdx is a valid envp"],
-                      effect: "execve(\"/bin/sh\", r13, rdx)")
-OneGadget::Gadget.add(build_id, 805894,
-                      constraints: ["[rsi] == NULL || rsi == NULL || rsi is a valid argv", "[rdx] == NULL || rdx == NULL || rdx is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rsi, rdx)")
-OneGadget::Gadget.add(build_id, 805936,
-                      constraints: ["writable: rbp-0x40", "rdi == NULL || {\"/bin/sh\", rdi, NULL} is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rbp-0x40, r12)")
-OneGadget::Gadget.add(build_id, 805943,
-                      constraints: ["writable: rbp-0x40", "rax == NULL || {rax, rdi, NULL} is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rbp-0x40, r12)")
-OneGadget::Gadget.add(build_id, 805947,
-                      constraints: ["writable: r13+0x10", "writable: rbp-0x40", "[r13] == NULL || r13 == NULL || r13 is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", r13, r12)")
-OneGadget::Gadget.add(build_id, 805950,
-                      constraints: ["writable: r13+0x10", "writable: rbp-0x40", "[r13] == NULL || r13 == NULL || r13 is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", r13, r12)")
-OneGadget::Gadget.add(build_id, 805954,
-                      constraints: ["writable: r13+0x10", "writable: rbp-0x40", "[r13] == NULL || r13 == NULL || r13 is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", r13, r12)")
-OneGadget::Gadget.add(build_id, 805958,
-                      constraints: ["writable: r13+0x10", "[r13] == NULL || r13 == NULL || r13 is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", r13, r12)")
-OneGadget::Gadget.add(build_id, 805968,
-                      constraints: ["writable: r13+0x10", "[r13] == NULL || r13 == NULL || r13 is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", r13, r12)")
-OneGadget::Gadget.add(build_id, 805976,
-                      constraints: ["[r13] == NULL || r13 == NULL || r13 is a valid argv", "[r12] == NULL || r12 == NULL || r12 is a valid envp"],
-                      effect: "execve(\"/bin/sh\", r13, r12)")
-OneGadget::Gadget.add(build_id, 927795,
-                      constraints: ["[rsp+0x38] != 0x0", "[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)",
-                      closed_fds: ["[rsp+0x5c]", "[rsp+0x58]"])
-OneGadget::Gadget.add(build_id, 927799,
-                      constraints: ["[rsp+0x38] != 0x0", "[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)",
-                      closed_fds: ["rdi", "[rsp+0x58]"])
-OneGadget::Gadget.add(build_id, 927804,
-                      constraints: ["[rsp+0x38] != 0x0", "[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)",
-                      closed_fds: ["[rsp+0x58]"])
-OneGadget::Gadget.add(build_id, 927808,
-                      constraints: ["ecx != 0x0", "[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)",
-                      closed_fds: ["[rsp+0x58]"])
-OneGadget::Gadget.add(build_id, 927898,
-                      constraints: ["([rsp+0x98] & 0xf000) == 0x2000", "[rsp+0xa8] == 0x103", "eax == 0x0", "[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)",
-                      closed_fds: ["[rsp+0x58]"])
-OneGadget::Gadget.add(build_id, 927902,
-                      constraints: ["([rsp+0x98] & 0xf000) == 0x2000", "[rsp+0xa8] == 0x103", "[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)",
-                      closed_fds: ["[rsp+0x58]"])
-OneGadget::Gadget.add(build_id, 927909,
-                      constraints: ["(eax & 0xf000) == 0x2000", "[rsp+0xa8] == 0x103", "[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)",
-                      closed_fds: ["[rsp+0x58]"])
-OneGadget::Gadget.add(build_id, 927914,
-                      constraints: ["[rsp+0xa8] == 0x103", "eax == 0x2000", "[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)",
-                      closed_fds: ["[rsp+0x58]"])
-OneGadget::Gadget.add(build_id, 927921,
-                      constraints: ["[rsp+0xa8] == 0x103", "[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)",
-                      closed_fds: ["[rsp+0x58]"])
-OneGadget::Gadget.add(build_id, 928074,
-                      constraints: ["[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)",
-                      closed_fds: ["[rsp+0x58]"])
-OneGadget::Gadget.add(build_id, 928087,
-                      constraints: ["[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)",
-                      closed_fds: ["[rsp+0x58]"])
-OneGadget::Gadget.add(build_id, 928091,
-                      constraints: ["[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)",
-                      closed_fds: ["rdi"])
-OneGadget::Gadget.add(build_id, 928096,
-                      constraints: ["[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)")
-OneGadget::Gadget.add(build_id, 928103,
-                      constraints: ["readable: rax", "[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv", "[[rax]] == NULL || [rax] == NULL || [rax] is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, [rax])")
-OneGadget::Gadget.add(build_id, 928108,
-                      constraints: ["readable: rax", "[rsi] == NULL || rsi == NULL || rsi is a valid argv", "[[rax]] == NULL || [rax] == NULL || [rax] is a valid envp"],
-                      effect: "execve(\"/bin/sh\", rsi, [rax])")
-OneGadget::Gadget.add(build_id, 928154,
-                      constraints: ["[rsp+0x38] != 0x0", "[rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv"],
-                      effect: "execve(\"/bin/sh\", rsp+0x60, environ)",
-                      closed_fds: ["[rsp+0x58]"])
-