Add new ROP feature: relative stack offset

[CsomePro]

Add new ROP feature: relative stack offset

Sometimes, the ROP needs to be set using the relative offset position on the stack.

This is a temporary solution.

rop = ROP(elf)
rop.rbp = len(rop.chain()) + 8 + offset

But sometimes errors occur.

rop = ROP(elf)
rop.call("open", [b"file", 0])
rop.rbp = len(rop.chain()) + 8 + offset

Because of the existence of AppendedArgument, arguments will be placed at the end of the stack.

len(rop.chain()) will not be the correct offset from base to the current slot.

Therefore, I added a class StackRelative and added the processing logic for StackRelative in the ROP.build function

class StackRelative(Unresolved):
    def __init__(self, offset):
        self.offset = offset
    
    def resolve(self, base):
        return base + self.offset

        ...
        elif isinstance(slot, StackRelative):
            address = slot.resolve(slot_address)
            stack[i] = address
            stack.describe(self.describe(address), slot_address)
        ...

At this point we can use this to solve the above example.

rop = ROP(elf)
rop.call("open", [b"file", 0])
rop.rbp = StackRelative(offset)

[peace-maker]

Nice, can you please add a test to the ROP class itself or the module at the top which verifies this works as expected? You can look at the other tests which use ELF.from_assembly to setup a test binary with required gadgets manually. That way other users can learn about the existence of this new feature too.

[CsomePro]

I added the StackRelative test at the top of rop.py. And this test error seems to be a problem with the libcdb module.

[peace-maker]

This reminds me of labels for flat as proposed in #1026 #1063 but the ROP class is a different space. I don't think that label concept is really applicable for rop chains?

[CsomePro]

This reminds me of labels for flat as proposed in #1026 #1063 but the ROP class is a different space. I don't think that label concept is really applicable for rop chains?

I am also thinking about this question. If I want to set an address precisely to the front or back of a gadget or data during ROP writing, due to the encapsulation of some ROP layouts, how should I do this? Since the length of the data after the gadget is uncertain, it seems difficult to achieve this requirement.

[CsomePro]

The document is complete and can be reviewed.

[peace-maker]

I though about it again. (Happy anniversary to the PR 🎉)
That StackRelative class requires you to know the gadget it is used in in order to enter the right magic offset right after that gadget. You don't know which gadget is used to set the register in rop.rbp = 0x1234. Maybe there is a pop rbp; ret gadget, but maybe there's just a pop rbp; pop rcx; ret. Since you need to skip the rop gadget in your relative offset, you'd have to somehow know which gadget is used. The ROP class doesn't tell you this and you're not supposed to have to worry about it.

Right now you'd even have to manually import the StackRelative class, so a ROP.relative(self, offset: int) -> StackRelative function would be convenient to construct that object for you, but that manual offset calculation is error prone.

I think adding something like labels would be applicable to more use cases:

Add a way to assign a label to the position in the rop chain and allow to reference that label anywhere. Labels would only work when the base address of the rop chain is known and passed to the ROP class.

from pwn import *
context.clear(arch='amd64')
assembly = 'special_gadget: pop rdx; leave; ret; pop rdi; ret; pop rsi; ret; pop rbp; ret'
binary = ELF.from_assembly(assembly)
binary.symbols['funcname'] = binary.entry + 0x1000

rop = ROP(binary, base=stack)
rop.call("funcname", [b"arg0", b"arg1"])
# set rbp to address of "step1" - 8
rop.rbp = rop.uselabel("step1", offset=-8)
rop.raw(binary.symbols['special_gadget'])
rop.raw(0xdeadbeef)     # control rdx (and rbp after leave)
# store current offset while building the chain
rop.setlabel("step1")
rop.call("funcname", [b"hello", b"world"])
print(rop.dump())

To set the value of rbp through leave in one go, we'd have to leave out the offset when using the label:

rop = ROP(binary, base=stack)
rop.call("funcname", [b"arg0", b"arg1"])
# set rbp to address of "step1" -> `pop rbp; ret` based on that new `rsp`
rop.rbp = rop.uselabel("step1")
rop.raw(binary.symbols['special_gadget'])
rop.raw(0xdeadbeef)     # control rdx
# store current offset while building the chain
rop.setlabel("step1")
rop.raw(0xbeef)   # rbp after leave
rop.call("funcname", [b"hello", b"world"])

Your use case of gadgets ending in leave; ret could be automated I think.

Thoughts? Would this work for your usecase?

[peace-maker]

Superceded by #2734.