lock instructions should be banned about rp HOT 3 CLOSED

Indeed you are right -- I did a bit of debugging this afternoon, and
BeaEngine actually sees the LockPrefix:

[image: Images intégrées 1]

It considers it as "InvalidPrefix" (http://www.beaengine.org/prefstruct)
though for some reasons. I guess I'll have to dig BeaEngine to try and fix
that then.

Cheers,
0vercl0k

2015-03-07 6:13 GMT-08:00 agix [email protected]:

When looking for gadgets, lock prefixed instructions are not filtered (or
even marked).

SIGILL occurs then, breaking the ropchain.

python -c 'import sys; sys.stdout.write("f04889cec3".decode("hex"))' > bin
ndisasm -b64 bin
00000000 F04889CE lock mov rsi,rcx
00000004 C3 ret
rp-lin-x64 --raw=x64 -f bin -r 1
0x00000000: mov rsi, rcx ; ret ; (1 found)

—
Reply to this email directly or view it on GitHub
#6.

from rp.

As Beatrix seems to be back from the dead and fairly actively working on BeaEngine5, I've filed this issue: BeaEngine/beaengine#9 ; hopefully we'll finally have this fixed.

Cheers

from rp.

PS D:\Codes\rp++\bin\Debug> .\rp-win-x64.exe --file D:\agix.bin --rop=3 --raw=x64
Trying to open 'D:\agix.bin'..
FileFormat: raw, Arch: x64

Wait a few seconds, rp++ is looking for gadgets (2 threads max)..
A total of 4 gadgets found.
0x00000004: ret  ;  \xc3 (1 found)
0x00000000: lock mov rsi, rcx ; ret  ;  \xf0\x48\x89\xce\xc3 (1 found)
0x00000001: mov rsi, rcx ; ret  ;  \x48\x89\xce\xc3 (1 found)
0x00000002: mov esi, ecx ; ret  ;  \x89\xce\xc3 (1 found)

I'm closing this now, feel free to re-open if you find other instances of this issue.

Cheers

from rp.