You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
ropr currently returns rop gadgets within DISCARDABLE sections of an executable file. This is generally fine as this flag/characteristics is ignore for userland binaries but when working with kernel mode drives/executables, such as with ntoskrnl.exe, the DISCARDABLE flag causes "the contents will be removed from memory after initialization is complete" (reference: https://devblogs.microsoft.com/oldnewthing/20120712-00/?p=7143).
It would be cool to have the option to exclude these sections from ropr output (with something like --skip-discardable) to prevent being polluted with unusable gadgets.
It should be fairly easy to identify sections marked DISCARDABLE as it will be in the section characteristics.
The text was updated successfully, but these errors were encountered:
Hello,
ropr currently returns rop gadgets within DISCARDABLE sections of an executable file. This is generally fine as this flag/characteristics is ignore for userland binaries but when working with kernel mode drives/executables, such as with ntoskrnl.exe, the DISCARDABLE flag causes "the contents will be removed from memory after initialization is complete" (reference: https://devblogs.microsoft.com/oldnewthing/20120712-00/?p=7143).
For example, on ntoskrnl.exe, (see https://pedump.me/42a130909c358ce63f80c1a9dd0a061d/#pe), any section marked DISCARDABLE will be randomized every boot.
Proof:
It would be cool to have the option to exclude these sections from ropr output (with something like --skip-discardable) to prevent being polluted with unusable gadgets.
It should be fairly easy to identify sections marked DISCARDABLE as it will be in the section characteristics.
The text was updated successfully, but these errors were encountered: