Corelan Cybersecurity Research

This page contains a collection of rop gadgets that can be found in commonly used Windows OS dll’s and common applications. All gadget text files were generated with pvefindaddr. If you are building a rop based exploit and want to use rop gadgets from one of those dll’s, you can simply download the text files (instead of having to create them yourself).

Note : if your exploit takes advantage of a SEH overwrite, you’ll need to find a stack pivot pointer from a non safeseh module.  Most of the OS dll’s are safeseh protected.

If you want to contribute your own rop gadgets, look here

Windows OS

Q : why is the kernel32.dll from Win7 in the list ? A : well, since you probably will try to grab/find a pointer into kernel32.dll anyway in order to bypass ASLR & DEP, you may be able to use a useful gadget in kernel32.dll at the same time.

Common applications

Firefox 3.6.6

Acrobat Reader 9.3.3

Microsoft Office 2010 (14.0.4734.1000)

Java SDK 1.6 update 21

iTunes 9.2.0.61

7zip 4.65

Foxit Reader 4.0.0.0619

Orbit 3.0.0.5

VirtualBox (guest environment, guest addition tools installed)

DEP Bypass Function Pointers

This table lists function pointers to commonly used DEP bypass functions. If the OS is ASLR aware, then the offset to the base address of the corresponding module is listed.

Contribute

If you want to share the output of a !pvefindaddr rop, ran against an OS module or application module (non aslr), please feel free send me the rop.txt file, the name of the application (if applicable), the dll version, the OS you built the rop.txt file on, and I’ll post all relevant info on this page.  (Make sure to restrict the rop.txt file to just one dll, and leave the loaded modules table, which sits at the top of the rop.txt file, intact.)

How to create a rop file ?

1. Make sure you have the latest version of pvefindaddr installed

2. Attach Immunity Debugger to an application that has a non aslr module

3. run  !pvefindaddr rop   (where is the name of the non aslr aware dll)

4. wait until the process completes, and send me an email with the rop.txt file, the name of the module, the version of the module, and the exact OS you used to create the rop file.

Thanks to the following people who have contributed so far : corelanc0d3r, _rs, dmc, sud0, Edi, Nicolas Krassas, dookie2000ca, Amirreza Aminsalehi

  Copyright secured by Digiprove © 2011 Peter Van Eeckhoutte