From a49ec0ea38e49a85a2b47e85cc1c79d1aa6af6c0 Mon Sep 17 00:00:00 2001 From: Kyle Zeng Date: Wed, 3 Jan 2024 07:29:00 -0700 Subject: [PATCH] well, we still need to use block_length as a gadget filter --- angrop/chain_builder/reg_setter.py | 2 +- angrop/rop_gadget.py | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/angrop/chain_builder/reg_setter.py b/angrop/chain_builder/reg_setter.py index 3e62167..91eba07 100644 --- a/angrop/chain_builder/reg_setter.py +++ b/angrop/chain_builder/reg_setter.py @@ -217,7 +217,7 @@ def _find_all_candidate_chains(self, gadgets, **registers): hard_chain = hard_chains[0] else: hard_chain = self._find_add_chain(gadgets, reg, val) - self.hard_chain_cache[key] = hard_chain + self.hard_chain_cache[key] = hard_chain # we cache the result even if it fails if not hard_chain: l.error("Fail to set register: %s to: %#x", reg, val) return [] diff --git a/angrop/rop_gadget.py b/angrop/rop_gadget.py index 53af150..bf2961b 100644 --- a/angrop/rop_gadget.py +++ b/angrop/rop_gadget.py @@ -134,7 +134,8 @@ def reg_better_than(self, other): return False if len(self.changed_regs) >= len(other.changed_regs) and \ self.stack_change <= other.stack_change and \ - self.num_mem_access <= other.num_mem_access: + self.num_mem_access <= other.num_mem_access and \ + self.block_length <= other.block_length: return True return False