disasm

README

DEPRECATION NOTICE

Please note that this repository has been deprecated and is no longer actively maintained by Polyverse Corporation. It may be removed in the future, but for now remains public for the benefit of any users.

Importantly, as the repository has not been maintained, it may contain unpatched security issues and other critical issues. Use at your own risk.

While it is not maintained, we would graciously consider any pull requests in accordance with our Individual Contributor License Agreement. https://github.com/polyverse/contributor-license-agreement

For any other issues, please feel free to contact info@polyverse.com

---

polyverse/disasm

This package is a stand-alone (x86_64 only) disassembler and ROP gadget enumerator. It locates all valid gadgets at all alignments within a given block of memory.

A gadget is currently defined as a block of code at some address that terminates with a "ret" (0xC3) instruction and contains no intervening unconditional "jmp" instructions (0xE9 0xEA 0xEB 0xFF). (TBD: This needs to be tighted up)

Test (While not a real go test module, it will disassemble a known buffer and dump the raw output.)

go test .

The nuts and bolts of the disassembler were pulled from the GNU binutils package. Binutils is a heavily interdependent set of utilities that tends to pull in the kitchen sink, so I extracted the bare essentials for the sake of size and expediency.

Documentation

Index

• func InfoFree(i *iInfo)
• type Gadget
  • func (g *Gadget) InstructionString() string
  • func (g *Gadget) String() string
• type Info
  • func InfoInit(s Ptr, e Ptr) Info
  • func InfoInitBytes(s Ptr, e Ptr, b []byte) Info
  • func (info *Info) DecodeGadget(pc Ptr, instructionsMin int, instructionsMax int, octetsMin int, octetsMax int) (*Gadget, error)
  • func (info *Info) DecodeInstruction(pc Ptr) (instruction *Instruction, err error)
  • func (info *Info) GetAllGadgets(instructionsMin int, instructionsMax int, octetsMin int, octetsMax int) ([]*Gadget, []error)
• type Instruction
  • func (i *Instruction) String() string
• type Len
• type Octets
  • func (o Octets) MarshalJSON() ([]byte, error)
  • func (o *Octets) UnmarshalJSON(b []byte) error
• type Ptr
  • func (p Ptr) MarshalJSON() ([]byte, error)
  • func (p Ptr) MarshalText() ([]byte, error)
  • func (p Ptr) String() string
  • func (p *Ptr) UnmarshalJSON(b []byte) error
  • func (p *Ptr) UnmarshalText(b []byte) error

Functions

func InfoFree

func InfoFree(i *iInfo)

Types

type Gadget

type Gadget struct {
	Address      Ptr            `json:"address,string"`
	Instructions []*Instruction `json:"instructions"`
}

func (*Gadget) InstructionString

func (g *Gadget) InstructionString() string

func (*Gadget) String

func (g *Gadget) String() string

type Info

type Info struct {
	// contains filtered or unexported fields
}

func InfoInit

func InfoInit(s Ptr, e Ptr) Info

func InfoInitBytes

func InfoInitBytes(s Ptr, e Ptr, b []byte) Info

func (*Info) DecodeGadget

func (info *Info) DecodeGadget(pc Ptr,
	instructionsMin int,
	instructionsMax int,
	octetsMin int,
	octetsMax int) (*Gadget, error)

func (*Info) DecodeInstruction

func (info *Info) DecodeInstruction(pc Ptr) (instruction *Instruction, err error)

func (*Info) GetAllGadgets

func (info *Info) GetAllGadgets(instructionsMin int, instructionsMax int, octetsMin int, octetsMax int) ([]*Gadget, []error)

type Instruction

type Instruction struct {
	Address Ptr    `json:"address,string"`
	Octets  Octets `json:"octets"`
	DisAsm  string `json:"disasm"`
}

func (*Instruction) String

func (i *Instruction) String() string

type Len

type Len uint64

type Octets

type Octets []byte

func (Octets) MarshalJSON

func (o Octets) MarshalJSON() ([]byte, error)

func (*Octets) UnmarshalJSON

func (o *Octets) UnmarshalJSON(b []byte) error

type Ptr

type Ptr uintptr

func (Ptr) MarshalJSON

func (p Ptr) MarshalJSON() ([]byte, error)

func (Ptr) MarshalText

func (p Ptr) MarshalText() ([]byte, error)

func (Ptr) String

func (p Ptr) String() string

func (*Ptr) UnmarshalJSON

func (p *Ptr) UnmarshalJSON(b []byte) error

func (*Ptr) UnmarshalText

func (p *Ptr) UnmarshalText(b []byte) error