{"id":18900196,"url":"https://github.com/boyan-milanov/ropium","last_synced_at":"2025-04-05T22:11:22.102Z","repository":{"id":45089707,"uuid":"121039426","full_name":"Boyan-MILANOV/ropium","owner":"Boyan-MILANOV","description":"ROPium is a tool that helps you building ROP exploits by finding and chaining gadgets together ","archived":false,"fork":false,"pushed_at":"2023-01-15T16:25:04.000Z","size":12017,"stargazers_count":384,"open_issues_count":7,"forks_count":42,"subscribers_count":12,"default_branch":"master","last_synced_at":"2025-03-29T21:09:17.918Z","etag":null,"topics":["binary-exploitation","chaining-gadgets","exploit-development","gadget","rop-chain","rop-exploits","rop-gadgets","security","security-vulnerability","semantic"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Boyan-MILANOV.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-02-10T17:55:25.000Z","updated_at":"2025-03-14T12:52:32.000Z","dependencies_parsed_at":"2023-02-09T23:00:46.695Z","dependency_job_id":null,"html_url":"https://github.com/Boyan-MILANOV/ropium","commit_stats":null,"previous_names":["boyan-milanov/ropgenerator"],"tags_count":10,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Boyan-MILANOV%2Fropium","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Boyan-MILANOV%2Fropium/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Boyan-MILANOV%2Fropium/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Boyan-MILANOV%2Fropium/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Boyan-MILANOV","download_url":"https://codeload.github.com/Boyan-MILANOV/ropium/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247406112,"owners_count":20933806,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["binary-exploitation","chaining-gadgets","exploit-development","gadget","rop-chain","rop-exploits","rop-gadgets","security","security-vulnerability","semantic"],"created_at":"2024-11-08T08:50:29.708Z","updated_at":"2025-04-05T22:11:22.083Z","avatar_url":"https://github.com/Boyan-MILANOV.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n\n\u003cp align=\"center\" \u003e\n\u003cimg width=50% src=\"/ressources/ropium_logo.png\"/\u003e\u003cbr /\u003e\u003cbr /\u003e\u003cbr /\u003e\n\u003c/p\u003e\n\n# About\n**ROPium** (ex-ROPGenerator) is a library/tool that makes ROP-exploits easy. It automatically extracts and analyses gadgets from binaries and\nlets you find ROP-chains with semantic queries. ROPium supports *X86* and *X64* architectures, soon to be \nextended with *ARM*.\n\nKey features:\n\n   - **Effortless**: ROPium works out-of-the-box with a smooth Command Line Interface\n   - **Python API**: It is easy to integrate ROPium in script thanks to its python API\n   - **Automatic chaining**: ROPium automatically combines gadgets to create complex ROP-chains\n   - **Advanced features**: ROPium supports function calls for various ABIs, syscalls, ...\n   - **Semantic queries**: ROPium queries are quick and convenient to write : ``rax=rbx+8``, ``[rdi+0x20]=rax``, ``rsi=[rbx+16]``, ``0x08040212(1, 2, rax)``, ``[0xdeadbeaf] = \"/bin/sh\\x00\"``, ``sys_execve(0xdeadbeef, 0, 0)``, ``sys_0x1(0)``, ``...``\n\n\n# Content\n- [About](#about)\n- [Installation](#installation)\n- [Getting started](#getting-started)\n   - [CLI tool](#cli-tool)\n   - [Python API](#python-api)\n- [Docker](#docker)\n- [Contact](#contact)\n- [Licence](#licence)\n- [Special thanks](#special-thanks)\n\n# Installation\nFirst install the [Capstone](https://github.com/aquynh/capstone) disassembly framework: \n\n      sudo apt-get install libcapstone-dev\n\nYou also need the latest [ROPgadget](https://github.com/JonathanSalwan/ROPgadget) release: \n\n      git clone https://github.com/JonathanSalwan/ROPgadget \u0026\u0026 cd ROPgadget\n      python setup.py install --user \n\nTo use the CLI tool, install [prompt_toolkit](https://github.com/prompt-toolkit/python-prompt-toolkit):\n      \n      pip3 install prompt_toolkit\n\nFinally install **ROPium**:\n\n      git clone https://github.com/Boyan-MILANOV/ropium \u0026\u0026 cd ropium\n      make\n      make test\n      sudo make install \n\n# Getting started\n\n### CLI tool\n\nThanks to a Command-Line-Interface wrapper, you can use ROPium interactively to quickly build ropchains:  \n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"/ressources/ropium.gif\" width=\"800\" align=\"middle\"\u003e\n\u003c/p\u003e\n\n### Python API\n\nDo you need to integrate ropchains directly in your scripts ? Good news, ROPium has a python API !\n\nLoading a binary and finding ropchains:\n```Python\nfrom ropium import *\nrop = ROPium(ARCH.X64)\nrop.load('/lib/x86_64-linux-gnu/libc-2.27.so')\n\nchain = rop.compile('rbx = [rax + 0x20]')\n```\n\nDumping a ropchain in various formats:\n```Python\n\u003e\u003e\u003e print( chain.dump() )\n\n0x000000000009a851 (sub rax, 0x10; ret)\n0x0000000000130018 (mov rax, qword ptr [rax + 0x30]; ret)\n0x0000000000052240 (push rax; pop rbx; ret)\n\n\u003e\u003e\u003e print(chain.dump('python'))\n\nfrom struct import pack\noff = 0x0\np = ''\np += pack('\u003cQ', 0x000000000009a851+off) # sub rax, 0x10; ret\np += pack('\u003cQ', 0x0000000000130018+off) # mov rax, qword ptr [rax + 0x30]; ret\np += pack('\u003cQ', 0x0000000000052240+off) # push rax; pop rbx; ret\n\n\u003e\u003e\u003e print(chain.dump('raw'))\n\nb'Q\\xa8\\t\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x13\\x00\\x00\\x00\\x00\\x00@\"\\x05\\x00\\x00\\x00\\x00\\x00'\n```\n\nSet constraints on ropchains:\n```Python\n# Bytes that should not appear in the ropchain\nrop.bad_bytes = [0x00, 0x0a, 0x0b]\n\n# Register that should not be clobbered by the ropchain\nrop.keep_regs = ['rsi', 'rdx']\n\n# Enable/Forbid ropchain to dereference registers that might hold invalid addresses\n# Safe mode is 'True' by default\nrop.safe_mem = False\n\n# Specify which ABI you want to use when calling functions\nrop.abi = ABI.X86_CDECL\n\n# Specify which system to target when doing syscalls\nrop.os = OS.LINUX\n```\n\n# Docker\n\nIf needed you can run ROPium in a docker container. The container can be generated from the *Dockerfile* as\nfollows:\n\n```bash\n# Create your docker image (this will take time!)\ndocker build . --tag ropium\n\n# Run the image in interactive mode, bind mounting the file to analyze\ndocker run --rm -it -v /FULL/HOST/PATH/FILE:/tmp/FILE:ro ropium\n\n(ropium)\u003e load -a X86 /tmp/FILE\n```\nThe actual image is around 200 MB based on a Debian Stretch with a Python 3.7.3 installed. \n\n# Contact\n\n**Boyan MILANOV** - boyan.milanov (at) hotmail (dot) fr\n\n# Licence\nROPium is provided under the MIT licence.\n\n# Special thanks\nContributors:\n   -  Docker container support: [migounette](https://github.com/migounette), [clslgrnc](https://github.com/clslgrnc)\n\nROPium uses the following awesome projects: \n   - [capstone](https://github.com/aquynh/capstone) : Disassembly Framework\n   - [ROPgadget](https://github.com/JonathanSalwan/ROPgadget) : Gadget extractor\n   - [prompt-toolkit](https://github.com/prompt-toolkit/python-prompt-toolkit) : Python CLI interface library\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fboyan-milanov%2Fropium","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fboyan-milanov%2Fropium","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fboyan-milanov%2Fropium/lists"}