Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a --skip-discardable flag to remove unusable rop gadgets from scrambled PE sections #19

Open
Acebond opened this issue Jan 24, 2025 · 0 comments

Comments

@Acebond
Copy link

Acebond commented Jan 24, 2025

Hello,

ropr currently returns rop gadgets within DISCARDABLE sections of an executable file. This is generally fine as this flag/characteristics is ignore for userland binaries but when working with kernel mode drives/executables, such as with ntoskrnl.exe, the DISCARDABLE flag causes "the contents will be removed from memory after initialization is complete" (reference: https://devblogs.microsoft.com/oldnewthing/20120712-00/?p=7143).

For example, on ntoskrnl.exe, (see https://pedump.me/42a130909c358ce63f80c1a9dd0a061d/#pe), any section marked DISCARDABLE will be randomized every boot.

Proof:
Image
Image
Image

It would be cool to have the option to exclude these sections from ropr output (with something like --skip-discardable) to prevent being polluted with unusable gadgets.

It should be fairly easy to identify sections marked DISCARDABLE as it will be in the section characteristics.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant