one_gadget 2.0.0 → 2.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (49) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +215 -65
  3. data/README.md +96 -22
  4. data/lib/one_gadget/abi.rb +41 -5
  5. data/lib/one_gadget/builds/libc-2.31-93b46e0027747153e336c3fd9431ce9a5d82ad00.rb +563 -0
  6. data/lib/one_gadget/builds/libc-2.35-891c1403437a4e30e684e0c8e34b87a09e4298e5.rb +434 -0
  7. data/lib/one_gadget/builds/libc-2.39-a1d1cf4badf1f5dfe57ff1d17bd692ccc6fcd5c5.rb +531 -0
  8. data/lib/one_gadget/builds/libc-2.39-cd8f5a207dd67aea370d2b471a54c3e56f44ab18.rb +531 -0
  9. data/lib/one_gadget/builds/libc-2.43-b50ceafbd17dc6bceee344a66671c7eaa152bef4.rb +15 -0
  10. data/lib/one_gadget/emulators/aarch64.rb +5 -2
  11. data/lib/one_gadget/emulators/amd64.rb +1 -0
  12. data/lib/one_gadget/emulators/arm.rb +27 -18
  13. data/lib/one_gadget/emulators/arm_family.rb +35 -160
  14. data/lib/one_gadget/emulators/conditional.rb +28 -22
  15. data/lib/one_gadget/emulators/constraints.rb +269 -0
  16. data/lib/one_gadget/emulators/data_processing.rb +167 -0
  17. data/lib/one_gadget/emulators/i386.rb +4 -6
  18. data/lib/one_gadget/emulators/instruction.rb +24 -1
  19. data/lib/one_gadget/emulators/lambda.rb +6 -4
  20. data/lib/one_gadget/emulators/mips.rb +289 -0
  21. data/lib/one_gadget/emulators/processor.rb +33 -455
  22. data/lib/one_gadget/emulators/register_file.rb +19 -10
  23. data/lib/one_gadget/emulators/riscv64.rb +265 -0
  24. data/lib/one_gadget/emulators/safe_calls.rb +9 -3
  25. data/lib/one_gadget/emulators/tracked_memory.rb +209 -0
  26. data/lib/one_gadget/emulators/x86.rb +32 -22
  27. data/lib/one_gadget/fetchers/aarch64.rb +0 -27
  28. data/lib/one_gadget/fetchers/amd64.rb +0 -24
  29. data/lib/one_gadget/fetchers/argument_resolution.rb +340 -0
  30. data/lib/one_gadget/fetchers/arm.rb +99 -44
  31. data/lib/one_gadget/fetchers/base.rb +142 -640
  32. data/lib/one_gadget/fetchers/candidate_walk.rb +150 -0
  33. data/lib/one_gadget/fetchers/disassembly.rb +252 -0
  34. data/lib/one_gadget/fetchers/dynamic_symbols.rb +104 -0
  35. data/lib/one_gadget/fetchers/i386.rb +5 -8
  36. data/lib/one_gadget/fetchers/mips.rb +478 -0
  37. data/lib/one_gadget/fetchers/objdump.rb +25 -3
  38. data/lib/one_gadget/fetchers/riscv64.rb +78 -0
  39. data/lib/one_gadget/fetchers/x86.rb +19 -0
  40. data/lib/one_gadget/fetchers.rb +22 -6
  41. data/lib/one_gadget/gadget.rb +27 -37
  42. data/lib/one_gadget/helper.rb +19 -5
  43. data/lib/one_gadget/one_gadget.rb +6 -0
  44. data/lib/one_gadget/version.rb +1 -1
  45. data/lib/one_gadget.rb +1 -1
  46. metadata +18 -6
  47. data/lib/one_gadget/builds/libc-2.26-2104f3d4ad5cf68603afbe7ba1a17f5ac99c5988.rb +0 -227
  48. data/lib/one_gadget/builds/libc-2.26-ddcc13122ddbfe5e5ef77d4ebe66d124ae5762c2.rb +0 -300
  49. data/lib/one_gadget/builds/libc-2.26-f65648a832414f2144ce795d75b6045a1ec2e252.rb +0 -199
data/lib/one_gadget/builds/libc-2.35-891c1403437a4e30e684e0c8e34b87a09e4298e5.rb ADDED
@@ -0,0 +1,434 @@
1
+ require 'one_gadget/gadget'
2
+ # http://ports.ubuntu.com/ubuntu-ports/pool/main/g/glibc/libc6_2.35-0ubuntu3.14_riscv64.deb
3
+ #
4
+ # RISC-V
5
+ #
6
+ # GNU C Library (Ubuntu GLIBC 2.35-0ubuntu3.14) stable release version 2.35.
7
+ # Copyright (C) 2022 Free Software Foundation, Inc.
8
+ # This is free software; see the source for copying conditions.
9
+ # There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
10
+ # PARTICULAR PURPOSE.
11
+ # Compiled by GNU CC version 11.4.0.
12
+ # libc ABIs: UNIQUE ABSOLUTE IFUNC
13
+ # For bug reporting instructions, please see:
14
+ # <https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
15
+
16
+ build_id = File.basename(__FILE__, '.rb').split('-').last
17
+ OneGadget::Gadget.add(build_id, 262068,
18
+ constraints: ["a3 != a4", "readable: s4", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
19
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
20
+ OneGadget::Gadget.add(build_id, 262068,
21
+ constraints: ["a3 == a4", "readable: s4", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
22
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
23
+ OneGadget::Gadget.add(build_id, 262070,
24
+ constraints: ["a3 != a4", "readable: s4", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
25
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
26
+ OneGadget::Gadget.add(build_id, 262070,
27
+ constraints: ["a3 == a4", "readable: s4", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
28
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
29
+ OneGadget::Gadget.add(build_id, 262072,
30
+ constraints: ["a3 != a4", "readable: s4", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
31
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
32
+ OneGadget::Gadget.add(build_id, 262072,
33
+ constraints: ["a3 == a4", "readable: s4", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
34
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
35
+ OneGadget::Gadget.add(build_id, 262076,
36
+ constraints: ["readable: s4", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
37
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
38
+ OneGadget::Gadget.add(build_id, 262080,
39
+ constraints: ["readable: s4", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
40
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
41
+ OneGadget::Gadget.add(build_id, 262082,
42
+ constraints: ["readable: s4", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "sp+0x1f8 == NULL || (u16)[sp+0x1f8] == 0x0"],
43
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, sp+0x1f8, sp+0x40, environ)")
44
+ OneGadget::Gadget.add(build_id, 262084,
45
+ constraints: ["readable: s4", "writable: s1", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "(u16)[s1] == 0x0"],
46
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, environ)")
47
+ OneGadget::Gadget.add(build_id, 262086,
48
+ constraints: ["readable: s4", "writable: a0", "writable: s1", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "(u16)[s1] == 0x0"],
49
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, environ)")
50
+ OneGadget::Gadget.add(build_id, 262090,
51
+ constraints: ["readable: s4", "writable: s1", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "(u16)[s1] == 0x0"],
52
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, environ)")
53
+ OneGadget::Gadget.add(build_id, 262092,
54
+ constraints: ["readable: a1", "writable: s1", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "(u16)[s1] == 0x0"],
55
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, environ)")
56
+ OneGadget::Gadget.add(build_id, 262094,
57
+ constraints: ["readable: a1", "writable: a0", "writable: s1", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "(u16)[s1] == 0x0"],
58
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, environ)")
59
+ OneGadget::Gadget.add(build_id, 262098,
60
+ constraints: ["writable: s1", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "(u16)[s1] == 0x0"],
61
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, environ)")
62
+ OneGadget::Gadget.add(build_id, 262100,
63
+ constraints: ["readable: a1", "writable: s1", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "(u16)[s1] == 0x0"],
64
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, environ)")
65
+ OneGadget::Gadget.add(build_id, 262102,
66
+ constraints: ["readable: a1", "writable: a0", "writable: s1", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "(u16)[s1] == 0x0"],
67
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, environ)")
68
+ OneGadget::Gadget.add(build_id, 262106,
69
+ constraints: ["writable: s1", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "(u16)[s1] == 0x0"],
70
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, environ)")
71
+ OneGadget::Gadget.add(build_id, 262108,
72
+ constraints: ["writable: s1", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "(u16)[s1] == 0x0"],
73
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, environ)")
74
+ OneGadget::Gadget.add(build_id, 262110,
75
+ constraints: ["writable: a0", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "s1 == NULL || (u16)[s1] == 0x0"],
76
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, environ)")
77
+ OneGadget::Gadget.add(build_id, 262114,
78
+ constraints: ["{\"sh\", \"-c\", s3, NULL} is a valid argv", "s1 == NULL || (u16)[s1] == 0x0"],
79
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, environ)")
80
+ OneGadget::Gadget.add(build_id, 262122,
81
+ constraints: ["readable: a5", "{\"sh\", \"-c\", s3, NULL} is a valid argv", "[[a5]] == NULL || [a5] == NULL || [a5] is a valid envp", "s1 == NULL || (u16)[s1] == 0x0"],
82
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, [a5])")
83
+ OneGadget::Gadget.add(build_id, 262124,
84
+ constraints: ["{\"sh\", \"-c\", s3, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s1 == NULL || (u16)[s1] == 0x0"],
85
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, a5)")
86
+ OneGadget::Gadget.add(build_id, 262128,
87
+ constraints: ["a6+0xec == NULL || {a6+0xec, \"-c\", s3, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s1 == NULL || (u16)[s1] == 0x0"],
88
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, a5)")
89
+ OneGadget::Gadget.add(build_id, 262132,
90
+ constraints: ["a6 == NULL || {a6, \"-c\", s3, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s1 == NULL || (u16)[s1] == 0x0"],
91
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, a5)")
92
+ OneGadget::Gadget.add(build_id, 262134,
93
+ constraints: ["[sp+0x40] == NULL || {[sp+0x40], \"-c\", s3, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s1 == NULL || (u16)[s1] == 0x0"],
94
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, sp+0x40, a5)")
95
+ OneGadget::Gadget.add(build_id, 262136,
96
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s1 == NULL || (u16)[s1] == 0x0"],
97
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, a4, a5)")
98
+ OneGadget::Gadget.add(build_id, 262140,
99
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s1 == NULL || (u16)[s1] == 0x0"],
100
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, a4, a5)")
101
+ OneGadget::Gadget.add(build_id, 262144,
102
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s1 == NULL || (u16)[s1] == 0x0"],
103
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, s1, a4, a5)")
104
+ OneGadget::Gadget.add(build_id, 262146,
105
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "a3 == NULL || (u16)[a3] == 0x0"],
106
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", 0, a3, a4, a5)")
107
+ OneGadget::Gadget.add(build_id, 262148,
108
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "a2 == NULL || (s32)[a2+0x4] <= 0x0", "a3 == NULL || (u16)[a3] == 0x0"],
109
+ effect: "posix_spawn(sp+0x4, \"/bin/sh\", a2, a3, a4, a5)")
110
+ OneGadget::Gadget.add(build_id, 372064,
111
+ constraints: ["s1 == 0x0", "writable: s6+0xc", "{\"sh\", \"-c\", s2, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
112
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
113
+ OneGadget::Gadget.add(build_id, 372068,
114
+ constraints: ["s1 == 0x0", "{\"sh\", \"-c\", s2, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
115
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
116
+ OneGadget::Gadget.add(build_id, 372072,
117
+ constraints: ["[s1+0xe8] == 0x0", "s3 == a1", "{\"sh\", \"-c\", s2, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
118
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
119
+ OneGadget::Gadget.add(build_id, 372082,
120
+ constraints: ["[s1+0xe8] == 0x0", "a0 == 0x0", "{\"sh\", \"-c\", s2, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
121
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
122
+ OneGadget::Gadget.add(build_id, 372084,
123
+ constraints: ["[s1+0xe8] == 0x0", "{\"sh\", \"-c\", s2, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
124
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
125
+ OneGadget::Gadget.add(build_id, 372086,
126
+ constraints: ["s1 == 0x0", "{\"sh\", \"-c\", s2, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
127
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
128
+ OneGadget::Gadget.add(build_id, 372088,
129
+ constraints: ["{\"sh\", \"-c\", s2, NULL} is a valid argv", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
130
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, environ)")
131
+ OneGadget::Gadget.add(build_id, 372096,
132
+ constraints: ["readable: a5", "{\"sh\", \"-c\", s2, NULL} is a valid argv", "[[a5]] == NULL || [a5] == NULL || [a5] is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
133
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, [a5])")
134
+ OneGadget::Gadget.add(build_id, 372098,
135
+ constraints: ["{\"sh\", \"-c\", s2, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
136
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, a5)")
137
+ OneGadget::Gadget.add(build_id, 372102,
138
+ constraints: ["a6+0x356 == NULL || {a6+0x356, \"-c\", s2, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
139
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, a5)")
140
+ OneGadget::Gadget.add(build_id, 372106,
141
+ constraints: ["a6 == NULL || {a6, \"-c\", s2, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
142
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, a5)")
143
+ OneGadget::Gadget.add(build_id, 372108,
144
+ constraints: ["[sp+0x38] == NULL || {[sp+0x38], \"-c\", s2, NULL} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
145
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, sp+0x38, a5)")
146
+ OneGadget::Gadget.add(build_id, 372110,
147
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
148
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, a4, a5)")
149
+ OneGadget::Gadget.add(build_id, 372114,
150
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
151
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, a4, a5)")
152
+ OneGadget::Gadget.add(build_id, 372118,
153
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0"],
154
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, 0, a4, a5)")
155
+ OneGadget::Gadget.add(build_id, 372120,
156
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "s5 == NULL || (s32)[s5+0x4] <= 0x0", "a3 == NULL || (u16)[a3] == 0x0"],
157
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", s5, a3, a4, a5)")
158
+ OneGadget::Gadget.add(build_id, 372122,
159
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "s0+0xe0 == NULL || writable: s0+0xe0", "a2 == NULL || (s32)[a2+0x4] <= 0x0", "a3 == NULL || (u16)[a3] == 0x0"],
160
+ effect: "posix_spawn(s0+0xe0, \"/bin/sh\", a2, a3, a4, a5)")
161
+ OneGadget::Gadget.add(build_id, 599926,
162
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
163
+ effect: "execve(\"/bin/sh\", sp-0x50, a2)")
164
+ OneGadget::Gadget.add(build_id, 599926,
165
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
166
+ effect: "execve(\"/bin/sh\", sp-0x70, a2)")
167
+ OneGadget::Gadget.add(build_id, 599928,
168
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
169
+ effect: "execve(\"/bin/sh\", sp, a2)")
170
+ OneGadget::Gadget.add(build_id, 599928,
171
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
172
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
173
+ OneGadget::Gadget.add(build_id, 599930,
174
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
175
+ effect: "execve(\"/bin/sh\", sp, a2)")
176
+ OneGadget::Gadget.add(build_id, 599930,
177
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
178
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
179
+ OneGadget::Gadget.add(build_id, 599932,
180
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
181
+ effect: "execve(\"/bin/sh\", sp, a2)")
182
+ OneGadget::Gadget.add(build_id, 599932,
183
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
184
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
185
+ OneGadget::Gadget.add(build_id, 599934,
186
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
187
+ effect: "execve(\"/bin/sh\", sp, a2)")
188
+ OneGadget::Gadget.add(build_id, 599934,
189
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
190
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
191
+ OneGadget::Gadget.add(build_id, 599936,
192
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
193
+ effect: "execve(\"/bin/sh\", sp, a2)")
194
+ OneGadget::Gadget.add(build_id, 599936,
195
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
196
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
197
+ OneGadget::Gadget.add(build_id, 599938,
198
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
199
+ effect: "execve(\"/bin/sh\", sp, a2)")
200
+ OneGadget::Gadget.add(build_id, 599938,
201
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
202
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
203
+ OneGadget::Gadget.add(build_id, 599940,
204
+ constraints: ["[a1] == 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
205
+ effect: "execve(\"/bin/sh\", sp, a2)")
206
+ OneGadget::Gadget.add(build_id, 599940,
207
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
208
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
209
+ OneGadget::Gadget.add(build_id, 599942,
210
+ constraints: ["[a1] == 0x0", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
211
+ effect: "execve(\"/bin/sh\", s0-0x50, a2)")
212
+ OneGadget::Gadget.add(build_id, 599942,
213
+ constraints: ["[a1+0x8] == 0x0", "[a1] != 0x0", "writable: s0-0x38", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
214
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
215
+ OneGadget::Gadget.add(build_id, 599944,
216
+ constraints: ["a3 == 0x0", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
217
+ effect: "execve(\"/bin/sh\", s0-0x50, a2)")
218
+ OneGadget::Gadget.add(build_id, 599944,
219
+ constraints: ["[a1+0x8] == 0x0", "a3 != 0x0", "writable: s0-0x38", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
220
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
221
+ OneGadget::Gadget.add(build_id, 599948,
222
+ constraints: ["a3 == 0x0", "readable: [s3-0xf0]", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
223
+ effect: "execve(\"/bin/sh\", s0-0x50, a2)")
224
+ OneGadget::Gadget.add(build_id, 599948,
225
+ constraints: ["[a1+0x8] == 0x0", "a3 != 0x0", "readable: [s3-0xf0]", "writable: s0-0x38", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
226
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
227
+ OneGadget::Gadget.add(build_id, 599952,
228
+ constraints: ["a3 == 0x0", "readable: s3", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
229
+ effect: "execve(\"/bin/sh\", s0-0x50, a2)")
230
+ OneGadget::Gadget.add(build_id, 599952,
231
+ constraints: ["[a1+0x8] == 0x0", "a3 != 0x0", "readable: s3", "writable: s0-0x38", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
232
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
233
+ OneGadget::Gadget.add(build_id, 599956,
234
+ constraints: ["a3 == 0x0", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
235
+ effect: "execve(\"/bin/sh\", s0-0x50, a2)")
236
+ OneGadget::Gadget.add(build_id, 599956,
237
+ constraints: ["[a1+0x8] == 0x0", "a3 != 0x0", "writable: s0-0x38", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
238
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
239
+ OneGadget::Gadget.add(build_id, 599960,
240
+ constraints: ["[a1+0x8] == 0x0", "a3 != 0x0", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
241
+ effect: "execve(\"/bin/sh\", sp-0x20, a2)")
242
+ OneGadget::Gadget.add(build_id, 599960,
243
+ constraints: ["a3 == 0x0", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
244
+ effect: "execve(\"/bin/sh\", s0-0x50, a2)")
245
+ OneGadget::Gadget.add(build_id, 599962,
246
+ constraints: ["a3 == 0x0", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
247
+ effect: "execve(\"/bin/sh\", s0-0x50, a2)")
248
+ OneGadget::Gadget.add(build_id, 599964,
249
+ constraints: ["a3 == 0x0", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
250
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
251
+ OneGadget::Gadget.add(build_id, 599966,
252
+ constraints: ["a3 == 0x0", "writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
253
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
254
+ OneGadget::Gadget.add(build_id, 600014,
255
+ constraints: ["a5 == 0x1", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
256
+ effect: "execve(\"/bin/sh\", sp, s2)")
257
+ OneGadget::Gadget.add(build_id, 600016,
258
+ constraints: ["a5 == 0x1", "writable: s1", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
259
+ effect: "execve(\"/bin/sh\", s1, s2)")
260
+ OneGadget::Gadget.add(build_id, 600020,
261
+ constraints: ["a5 == 0x1", "writable: s1", "a4-0x6e8 == NULL || {a4-0x6e8, a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
262
+ effect: "execve(\"/bin/sh\", s1, s2)")
263
+ OneGadget::Gadget.add(build_id, 600024,
264
+ constraints: ["a5 == 0x1", "writable: s1", "a4 == NULL || {a4, a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
265
+ effect: "execve(\"/bin/sh\", s1, s2)")
266
+ OneGadget::Gadget.add(build_id, 600026,
267
+ constraints: ["a5 == 0x1", "writable: s1+0x8", "[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
268
+ effect: "execve(\"/bin/sh\", s1, s2)")
269
+ OneGadget::Gadget.add(build_id, 600028,
270
+ constraints: ["a5 == 0x1", "writable: s1+0x10", "[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
271
+ effect: "execve(\"/bin/sh\", s1, s2)")
272
+ OneGadget::Gadget.add(build_id, 600030,
273
+ constraints: ["a5 == a4", "writable: s1+0x10", "[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
274
+ effect: "execve(\"/bin/sh\", s1, s2)")
275
+ OneGadget::Gadget.add(build_id, 600034,
276
+ constraints: ["writable: s1+0x10", "[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
277
+ effect: "execve(\"/bin/sh\", s1, s2)")
278
+ OneGadget::Gadget.add(build_id, 600038,
279
+ constraints: ["[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
280
+ effect: "execve(\"/bin/sh\", s1, s2)")
281
+ OneGadget::Gadget.add(build_id, 600040,
282
+ constraints: ["[s1] == NULL || s1 == NULL || s1 is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
283
+ effect: "execve(\"/bin/sh\", s1, a2)")
284
+ OneGadget::Gadget.add(build_id, 600042,
285
+ constraints: ["[a1] == NULL || a1 == NULL || a1 is a valid argv", "[a2] == NULL || a2 == NULL || a2 is a valid envp"],
286
+ effect: "execve(\"/bin/sh\", a1, a2)")
287
+ OneGadget::Gadget.add(build_id, 600098,
288
+ constraints: ["[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
289
+ effect: "execve(\"/bin/sh\", s1, s2)")
290
+ OneGadget::Gadget.add(build_id, 600118,
291
+ constraints: ["writable: s0-0x50", "a0 == NULL || {\"/bin/sh\", a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
292
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
293
+ OneGadget::Gadget.add(build_id, 600122,
294
+ constraints: ["writable: s0-0x50", "a5-0x74e == NULL || {a5-0x74e, a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
295
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
296
+ OneGadget::Gadget.add(build_id, 600126,
297
+ constraints: ["writable: s0-0x50", "a5 == NULL || {a5, a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
298
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
299
+ OneGadget::Gadget.add(build_id, 600130,
300
+ constraints: ["writable: s0-0x48", "[s0-0x50] == NULL || {[s0-0x50], a0, NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
301
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
302
+ OneGadget::Gadget.add(build_id, 600134,
303
+ constraints: ["writable: s0-0x40", "[s0-0x50] == NULL || {[s0-0x50], [s0-0x48], NULL} is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
304
+ effect: "execve(\"/bin/sh\", s0-0x50, s2)")
305
+ OneGadget::Gadget.add(build_id, 600138,
306
+ constraints: ["writable: s1+0x10", "[s1] == NULL || s1 == NULL || s1 is a valid argv", "[s2] == NULL || s2 == NULL || s2 is a valid envp"],
307
+ effect: "execve(\"/bin/sh\", s1, s2)")
308
+ OneGadget::Gadget.add(build_id, 683392,
309
+ constraints: ["a0 == 0x0", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
310
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, environ)")
311
+ OneGadget::Gadget.add(build_id, 683396,
312
+ constraints: ["[[[$base+0x1267c0]]] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
313
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
314
+ OneGadget::Gadget.add(build_id, 683400,
315
+ constraints: ["[[[a5-0x5c4]]] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
316
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
317
+ OneGadget::Gadget.add(build_id, 683404,
318
+ constraints: ["[[a5]] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
319
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
320
+ OneGadget::Gadget.add(build_id, 683408,
321
+ constraints: ["[s11] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
322
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
323
+ OneGadget::Gadget.add(build_id, 683410,
324
+ constraints: ["[s11] == 0x0", "[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
325
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
326
+ OneGadget::Gadget.add(build_id, 683414,
327
+ constraints: ["[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "s6 == 0x0", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
328
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
329
+ OneGadget::Gadget.add(build_id, 683430,
330
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
331
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
332
+ OneGadget::Gadget.add(build_id, 683434,
333
+ constraints: ["[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "s6 == 0x0", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
334
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
335
+ OneGadget::Gadget.add(build_id, 683436,
336
+ constraints: ["[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "s6 == 0x0", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
337
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
338
+ OneGadget::Gadget.add(build_id, 683462,
339
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd8] != -0x1", "a3+0x1 != [sp+0xd8]", "writable: ((a3 << 0x3) + [sp+0xe0])", "writable: ((a3+0x1 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "s6 == NULL || readable: s6", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
340
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
341
+ OneGadget::Gadget.add(build_id, 683466,
342
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd8] != -0x1", "a2 != [sp+0xd8]", "writable: ((a2 << 0x3) + [sp+0xe0])", "writable: ((a3 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "s6 == NULL || readable: s6", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
343
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
344
+ OneGadget::Gadget.add(build_id, 683468,
345
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "writable: ((a3 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "s6 == NULL || readable: s6", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
346
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
347
+ OneGadget::Gadget.add(build_id, 683470,
348
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "writable: ((a3 << 0x3) + a2)", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
349
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
350
+ OneGadget::Gadget.add(build_id, 683472,
351
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "writable: (a3 + a2)", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
352
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
353
+ OneGadget::Gadget.add(build_id, 683474,
354
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "writable: a3", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
355
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
356
+ OneGadget::Gadget.add(build_id, 683478,
357
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
358
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
359
+ OneGadget::Gadget.add(build_id, 683480,
360
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
361
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
362
+ OneGadget::Gadget.add(build_id, 683488,
363
+ constraints: ["[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
364
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
365
+ OneGadget::Gadget.add(build_id, 683490,
366
+ constraints: ["[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != a5", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
367
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
368
+ OneGadget::Gadget.add(build_id, 683494,
369
+ constraints: ["[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
370
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
371
+ OneGadget::Gadget.add(build_id, 683496,
372
+ constraints: ["[sp+0xd8] != -0x1", "a5 != s5", "writable: ((a5 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
373
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
374
+ OneGadget::Gadget.add(build_id, 683500,
375
+ constraints: ["[sp+0xd8] != -0x1", "writable: ((a5 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
376
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
377
+ OneGadget::Gadget.add(build_id, 683504,
378
+ constraints: ["[sp+0xd8] != -0x1", "writable: ((a5 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
379
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
380
+ OneGadget::Gadget.add(build_id, 683506,
381
+ constraints: ["[sp+0xd8] != -0x1", "writable: ((a5 << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
382
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
383
+ OneGadget::Gadget.add(build_id, 683508,
384
+ constraints: ["[sp+0xd8] != -0x1", "writable: ((a5 << 0x3) + a4)", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
385
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
386
+ OneGadget::Gadget.add(build_id, 683510,
387
+ constraints: ["[sp+0xd8] != -0x1", "writable: (a5 + a4)", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
388
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
389
+ OneGadget::Gadget.add(build_id, 683512,
390
+ constraints: ["[sp+0xd8] != -0x1", "writable: a5", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
391
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
392
+ OneGadget::Gadget.add(build_id, 683516,
393
+ constraints: ["[sp+0xd8] != -0x1", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
394
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
395
+ OneGadget::Gadget.add(build_id, 683518,
396
+ constraints: ["a4 != -0x1", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
397
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
398
+ OneGadget::Gadget.add(build_id, 683520,
399
+ constraints: ["a4 != a5", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
400
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
401
+ OneGadget::Gadget.add(build_id, 683524,
402
+ constraints: ["[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
403
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
404
+ OneGadget::Gadget.add(build_id, 683526,
405
+ constraints: ["[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
406
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, a5)")
407
+ OneGadget::Gadget.add(build_id, 683528,
408
+ constraints: ["[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "a2 == NULL || (s32)[a2+0x4] <= 0x0"],
409
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", a2, 0, sp+0x60, a5)")
410
+ OneGadget::Gadget.add(build_id, 683530,
411
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "a2 == NULL || (s32)[a2+0x4] <= 0x0"],
412
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", a2, 0, a4, a5)")
413
+ OneGadget::Gadget.add(build_id, 683532,
414
+ constraints: ["[a4] == NULL || a4 is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "a2 == NULL || (s32)[a2+0x4] <= 0x0", "a3 == NULL || (u16)[a3] == 0x0"],
415
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", a2, a3, a4, a5)")
416
+ OneGadget::Gadget.add(build_id, 684242,
417
+ constraints: ["[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
418
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, environ)")
419
+ OneGadget::Gadget.add(build_id, 684250,
420
+ constraints: ["readable: a5", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[a5]] == NULL || [a5] == NULL || [a5] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
421
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [a5])")
422
+ OneGadget::Gadget.add(build_id, 684252,
423
+ constraints: ["[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[a5] == NULL || a5 == NULL || a5 is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
424
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, a5)")
425
+ OneGadget::Gadget.add(build_id, 684262,
426
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != [sp+0xd8]", "[sp+0xd8] != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
427
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
428
+ OneGadget::Gadget.add(build_id, 684264,
429
+ constraints: ["[s11+0x8] == 0x0", "[sp+0xd0] != s5", "[sp+0xd8] != -0x1", "s5 != -0x1", "writable: (([sp+0xd0] << 0x3) + [sp+0xe0])", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
430
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
431
+ OneGadget::Gadget.add(build_id, 684338,
432
+ constraints: ["[sp+0xd8] != -0x1", "[sp+0x60] == NULL || {[sp+0x60], [sp+0x68], [sp+0x70], [sp+0x78], ...} is a valid argv", "[[sp+0xe0]] == NULL || [sp+0xe0] == NULL || [sp+0xe0] is a valid envp", "[sp+0x28] == NULL || (s32)[[sp+0x28]+0x4] <= 0x0"],
433
+ effect: "posix_spawn(sp+0x54, \"/bin/sh\", [sp+0x28], 0, sp+0x60, [sp+0xe0])")
434
+