{"id":13537368,"url":"https://github.com/david942j/one_gadget","last_synced_at":"2025-05-11T03:50:29.990Z","repository":{"id":38325500,"uuid":"81182710","full_name":"david942j/one_gadget","owner":"david942j","description":"The best tool for finding one gadget RCE in libc.so.6","archived":false,"fork":false,"pushed_at":"2025-05-05T22:33:20.000Z","size":14277,"stargazers_count":2157,"open_issues_count":2,"forks_count":142,"subscribers_count":26,"default_branch":"master","last_synced_at":"2025-05-08T17:17:01.098Z","etag":null,"topics":["ctf","exploit","gadget","glibc","libc","one-gadget-rce","pwn","pwnable","shell"],"latest_commit_sha":null,"homepage":"","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/david942j.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2017-02-07T08:03:34.000Z","updated_at":"2025-05-06T21:08:28.000Z","dependencies_parsed_at":"2024-08-23T16:28:03.728Z","dependency_job_id":"2c26672f-6550-44a0-aa58-95d6f5ee9845","html_url":"https://github.com/david942j/one_gadget","commit_stats":{"total_commits":274,"total_committers":11,"mean_commits":24.90909090909091,"dds":0.3284671532846716,"last_synced_commit":"f640cd80b330953c9df25aa39d762e8873d81146"},"previous_names":[],"tags_count":30,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/david942j%2Fone_gadget","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/david942j%2Fone_gadget/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/david942j%2Fone_gadget/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/david942j%2Fone_gadget/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/david942j","download_url":"https://codeload.github.com/david942j/one_gadget/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253514567,"owners_count":21920334,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ctf","exploit","gadget","glibc","libc","one-gadget-rce","pwn","pwnable","shell"],"created_at":"2024-08-01T09:00:58.183Z","updated_at":"2025-05-11T03:50:29.970Z","avatar_url":"https://github.com/david942j.png","language":"Ruby","funding_links":[],"categories":["\u003ca id=\"9eee96404f868f372a6cbc6769ccb7f8\"\u003e\u003c/a\u003e新添加的","Exploits","Pentesting","Exploiting / Pwn","shell"],"sub_categories":["\u003ca id=\"31185b925d5152c7469b963809ceb22d\"\u003e\u003c/a\u003e新添加的","ShellCodes"],"readme":"[![Gem Version](https://badge.fury.io/rb/one_gadget.svg)](https://badge.fury.io/rb/one_gadget)\n[![Build Status](https://github.com/david942j/one_gadget/workflows/build/badge.svg)](https://github.com/david942j/one_gadget/actions)\n[![Downloads](http://ruby-gem-downloads-badge.herokuapp.com/one_gadget?type=total\u0026color=orange)](https://rubygems.org/gems/one_gadget)\n[![Code Climate](https://codeclimate.com/github/david942j/one_gadget/badges/gpa.svg)](https://codeclimate.com/github/david942j/one_gadget)\n[![Issue Count](https://codeclimate.com/github/david942j/one_gadget/badges/issue_count.svg)](https://codeclimate.com/github/david942j/one_gadget)\n[![Test Coverage](https://codeclimate.com/github/david942j/one_gadget/badges/coverage.svg)](https://codeclimate.com/github/david942j/one_gadget/coverage)\n[![Inline docs](https://inch-ci.org/github/david942j/one_gadget.svg?branch=master)](https://inch-ci.org/github/david942j/one_gadget)\n[![Yard Docs](http://img.shields.io/badge/yard-docs-blue.svg)](https://www.rubydoc.info/github/david942j/one_gadget/)\n[![MIT License](https://img.shields.io/badge/license-MIT-blue.svg)](http://choosealicense.com/licenses/mit/)\n\n## OneGadget\n\nWhen playing ctf pwn challenges we usually need the one-gadget RCE (remote code execution),\nwhich leads to call `execve('/bin/sh', NULL, NULL)`.\n\nThis gem provides such gadgets finder, no need to use objdump or IDA-pro every time like a fool :wink:\n\nTo use this tool, type `one_gadget /path/to/libc` in command line and enjoy the magic :laughing:\n\n## Installation\n\nAvailable on RubyGems.org!\n```bash\n$ gem install one_gadget\n```\n\nNote: requires ruby version \u003e= 2.1.0, you can use `ruby --version` to check.\n\n## Supported Architectures\n\n- [x] i386\n- [x] amd64 (x86-64)\n- [x] aarch64 (ARMv8)\n\n## Implementation\n\nOneGadget uses symbolic execution to find the constraints of gadgets to be successful.\n\nThe article introducing how I develop this tool can be found [on my blog](https://david942j.blogspot.com/2017/02/project-one-gadget-in-glibc.html).\n\n## Usage\n\n### Command Line Interface\n\n```bash\n$ one_gadget\n# Usage: one_gadget \u003cFILE|-b BuildID\u003e [options]\n#     -b, --build-id BuildID           BuildID[sha1] of libc.\n#     -f, --[no-]force-file            Force search gadgets in file instead of build id first.\n#     -l, --level OUTPUT_LEVEL         The output level.\n#                                      OneGadget automatically selects gadgets with higher successful probability.\n#                                      Increase this level to ask OneGadget show more gadgets it found.\n#                                      Default: 0\n#     -n, --near FUNCTIONS/FILE        Order gadgets by their distance to the given functions or to the GOT functions of the given file.\n#     -o, --output-format FORMAT       Output format. FORMAT should be one of \u003cpretty|raw|json\u003e.\n#                                      Default: pretty\n#     -r, --raw                        Alias of -o raw. Output gadgets offset only, split with one space.\n#     -s, --script exploit-script      Run exploit script with all possible gadgets.\n#                                      The script will be run as 'exploit-script $offset'.\n#         --info BuildID               Show version information given BuildID.\n#         --base BASE_ADDRESS          The base address of libc.\n#                                      Default: 0\n#         --version                    Current gem version.\n\n```\n\n```bash\n$ one_gadget /lib/x86_64-linux-gnu/libc.so.6\n# 0xe3afe execve(\"/bin/sh\", r15, r12)\n# constraints:\n#   [r15] == NULL || r15 == NULL || r15 is a valid argv\n#   [r12] == NULL || r12 == NULL || r12 is a valid envp\n#\n# 0xe3b01 execve(\"/bin/sh\", r15, rdx)\n# constraints:\n#   [r15] == NULL || r15 == NULL || r15 is a valid argv\n#   [rdx] == NULL || rdx == NULL || rdx is a valid envp\n#\n# 0xe3b04 execve(\"/bin/sh\", rsi, rdx)\n# constraints:\n#   [rsi] == NULL || rsi == NULL || rsi is a valid argv\n#   [rdx] == NULL || rdx == NULL || rdx is a valid envp\n\n```\n![x86_64](https://github.com/david942j/one_gadget/blob/master/examples/x86_64.png?raw=true)\n\n#### Given BuildID\n```bash\n$ one_gadget -b aad7dbe330f23ea00ca63daf793b766b51aceb5d\n# 0x4557a execve(\"/bin/sh\", rsp+0x30, environ)\n# constraints:\n#   [rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv\n#\n# 0xf1651 execve(\"/bin/sh\", rsp+0x40, environ)\n# constraints:\n#   [rsp+0x40] == NULL || {[rsp+0x40], [rsp+0x48], [rsp+0x50], [rsp+0x58], ...} is a valid argv\n#\n# 0xf24cb execve(\"/bin/sh\", rsp+0x60, environ)\n# constraints:\n#   [rsp+0x60] == NULL || {[rsp+0x60], [rsp+0x68], [rsp+0x70], [rsp+0x78], ...} is a valid argv\n\n```\n![build id](https://github.com/david942j/one_gadget/blob/master/examples/from_build_id.png?raw=true)\n\n#### Gadgets Near Functions\n\n##### Why\n\nConsider this scenario when exploiting:\n1. Able to write on GOT (Global Offset Table)\n2. Base address of libc is *unknown*\n\nIn this scenario you can choose to write two low-byte on a GOT entry with one-gadget's two low-byte.\nIf the function offset on GOT is close enough with the one-gadget,\nyou will have at least 1/16 chance of success.\n\n##### Usage\n\nReorder gadgets according to the distance of given functions.\n\n```bash\n$ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --near exit,mkdir\n# [OneGadget] Gadgets near exit(0x46a40):\n# 0xe3afe execve(\"/bin/sh\", r15, r12)\n# constraints:\n#   [r15] == NULL || r15 == NULL || r15 is a valid argv\n#   [r12] == NULL || r12 == NULL || r12 is a valid envp\n#\n# 0xe3b01 execve(\"/bin/sh\", r15, rdx)\n# constraints:\n#   [r15] == NULL || r15 == NULL || r15 is a valid argv\n#   [rdx] == NULL || rdx == NULL || rdx is a valid envp\n#\n# 0xe3b04 execve(\"/bin/sh\", rsi, rdx)\n# constraints:\n#   [rsi] == NULL || rsi == NULL || rsi is a valid argv\n#   [rdx] == NULL || rdx == NULL || rdx is a valid envp\n#\n# [OneGadget] Gadgets near mkdir(0x10de70):\n# 0xe3b04 execve(\"/bin/sh\", rsi, rdx)\n# constraints:\n#   [rsi] == NULL || rsi == NULL || rsi is a valid argv\n#   [rdx] == NULL || rdx == NULL || rdx is a valid envp\n#\n# 0xe3b01 execve(\"/bin/sh\", r15, rdx)\n# constraints:\n#   [r15] == NULL || r15 == NULL || r15 is a valid argv\n#   [rdx] == NULL || rdx == NULL || rdx is a valid envp\n#\n# 0xe3afe execve(\"/bin/sh\", r15, r12)\n# constraints:\n#   [r15] == NULL || r15 == NULL || r15 is a valid argv\n#   [r12] == NULL || r12 == NULL || r12 is a valid envp\n#\n\n```\n![near](https://github.com/david942j/one_gadget/blob/master/examples/near.png?raw=true)\n\nRegular expression is acceptable.\n```bash\n$ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --near 'write.*' --raw\n# [OneGadget] Gadgets near writev(0x114690):\n# 932612 932609 932606\n#\n# [OneGadget] Gadgets near write(0x10e280):\n# 932612 932609 932606\n#\n\n```\n\nPass an ELF file as the argument, OneGadget will take all GOT functions for processing.\n```bash\n$ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --near spec/data/test_near_file.elf --raw\n# [OneGadget] Gadgets near exit(0x46a40):\n# 932606 932609 932612\n#\n# [OneGadget] Gadgets near puts(0x84420):\n# 932606 932609 932612\n#\n# [OneGadget] Gadgets near printf(0x61c90):\n# 932606 932609 932612\n#\n# [OneGadget] Gadgets near strlen(0x9f630):\n# 932606 932609 932612\n#\n# [OneGadget] Gadgets near __cxa_finalize(0x46f10):\n# 932606 932609 932612\n#\n# [OneGadget] Gadgets near __libc_start_main(0x23f90):\n# 932606 932609 932612\n#\n\n```\n\n#### Show All Gadgets\n\nSometimes `one_gadget` finds too many gadgets to show them in one screen,\nby default gadgets would be filtered automatically *according to the difficulty of constraints*.\n\nUse option `--level 1` to show all gadgets found instead of only those with higher probabilities.\n\n```bash\n$ one_gadget /lib/x86_64-linux-gnu/libc.so.6 --level 1\n# 0x51dfb posix_spawn(rsp+0xc, \"/bin/sh\", 0, rbp, rsp+0x50, environ)\n# constraints:\n#   address rsp+0x60 is writable\n#   rsp \u0026 0xf == 0\n#   {\"sh\", \"-c\", rbx, NULL} is a valid argv\n#   rbp == NULL || (u16)[rbp] == NULL\n#\n# 0x51e02 posix_spawn(rsp+0xc, \"/bin/sh\", 0, rbp, rsp+0x50, environ)\n# constraints:\n#   address rsp+0x60 is writable\n#   rsp \u0026 0xf == 0\n#   rax == NULL || {\"sh\", rax, rbx, NULL} is a valid argv\n#   rbp == NULL || (u16)[rbp] == NULL\n#\n# 0x51e09 posix_spawn(rsp+0xc, \"/bin/sh\", 0, rbp, rsp+0x50, environ)\n# constraints:\n#   address rsp+0x60 is writable\n#   rsp \u0026 0xf == 0\n#   rcx == NULL || {rcx, rax, rbx, NULL} is a valid argv\n#   rbp == NULL || (u16)[rbp] == NULL\n#\n# 0x51e10 posix_spawn(rsp+0xc, \"/bin/sh\", rdx, rbp, rsp+0x50, environ)\n# constraints:\n#   address rsp+0x60 is writable\n#   rsp \u0026 0xf == 0\n#   rcx == NULL || {rcx, (u64)xmm1, rbx, NULL} is a valid argv\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#   rbp == NULL || (u16)[rbp] == NULL\n#\n# 0x51e15 posix_spawn(rsp+0xc, \"/bin/sh\", rdx, rbp, rsp+0x50, environ)\n# constraints:\n#   address rsp+0x60 is writable\n#   rsp \u0026 0xf == 0\n#   (u64)xmm0 == NULL || {(u64)xmm0, (u64)xmm1, rbx, NULL} is a valid argv\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#   rbp == NULL || (u16)[rbp] == NULL\n#\n# 0x51e25 posix_spawn(rdi, \"/bin/sh\", rdx, rbp, rsp+0x50, [rax])\n# constraints:\n#   address rsp+0x60 is writable\n#   rsp \u0026 0xf == 0\n#   (u64)xmm0 == NULL || {(u64)xmm0, (u64)(xmm0 \u003e\u003e 64), rbx, NULL} is a valid argv\n#   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp\n#   rdi == NULL || writable: rdi\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#   rbp == NULL || (u16)[rbp] == NULL\n#\n# 0x51e2a posix_spawn(rdi, \"/bin/sh\", rdx, rbp, r8, [rax])\n# constraints:\n#   address rsp+0x60 is writable\n#   rsp \u0026 0xf == 0\n#   [r8] == NULL || r8 is a valid argv\n#   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp\n#   rdi == NULL || writable: rdi\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#   rbp == NULL || (u16)[rbp] == NULL\n#\n# 0x51e2d posix_spawn(rdi, \"/bin/sh\", rdx, rcx, r8, [rax])\n# constraints:\n#   address rsp+0x60 is writable\n#   rsp \u0026 0xf == 0\n#   [r8] == NULL || r8 is a valid argv\n#   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp\n#   rdi == NULL || writable: rdi\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#   rcx == NULL || (u16)[rcx] == NULL\n#\n# 0x51e32 posix_spawn(rdi, \"/bin/sh\", rdx, rcx, r8, [rax])\n# constraints:\n#   address rsp+0x68 is writable\n#   rsp \u0026 0xf == 0\n#   [r8] == NULL || r8 is a valid argv\n#   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp\n#   rdi == NULL || writable: rdi\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#   rcx == NULL || (u16)[rcx] == NULL\n#\n# 0x84135 posix_spawn(rbx+0xe0, \"/bin/sh\", r12, 0, rsp+0x60, environ)\n# constraints:\n#   address rsp+0x70 is writable\n#   rsp \u0026 0xf == 0\n#   {\"sh\", \"-c\", rbp, NULL} is a valid argv\n#   rbx+0xe0 == NULL || writable: rbx+0xe0\n#   r12 == NULL || (s32)[r12+0x4] \u003c= 0\n#\n# 0x8413c posix_spawn(rbx+0xe0, \"/bin/sh\", r12, 0, rsp+0x60, environ)\n# constraints:\n#   address rsp+0x70 is writable\n#   rsp \u0026 0xf == 0\n#   rax == NULL || {\"sh\", rax, rbp, NULL} is a valid argv\n#   rbx+0xe0 == NULL || writable: rbx+0xe0\n#   r12 == NULL || (s32)[r12+0x4] \u003c= 0\n#\n# 0x84143 posix_spawn(rbx+0xe0, \"/bin/sh\", r12, 0, rsp+0x60, environ)\n# constraints:\n#   address rsp+0x70 is writable\n#   rsp \u0026 0xf == 0\n#   rcx == NULL || {rcx, rax, rbp, NULL} is a valid argv\n#   rbx+0xe0 == NULL || writable: rbx+0xe0\n#   r12 == NULL || (s32)[r12+0x4] \u003c= 0\n#\n# 0x84146 posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, 0, rsp+0x60, environ)\n# constraints:\n#   address rsp+0x70 is writable\n#   rsp \u0026 0xf == 0\n#   rcx == NULL || {rcx, rax, rbp, NULL} is a valid argv\n#   rbx+0xe0 == NULL || writable: rbx+0xe0\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#\n# 0x8414b posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, 0, rsp+0x60, environ)\n# constraints:\n#   address rsp+0x78 is writable\n#   rsp \u0026 0xf == 0\n#   rcx == NULL || {rcx, rax, [rsp+0x70], NULL} is a valid argv\n#   rbx+0xe0 == NULL || writable: rbx+0xe0\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#\n# 0x84150 posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, 0, rsp+0x60, environ)\n# constraints:\n#   address rsp+0x78 is writable\n#   rsp \u0026 0xf == 0\n#   rcx == NULL || {rcx, (u64)xmm1, [rsp+0x70], NULL} is a valid argv\n#   rbx+0xe0 == NULL || writable: rbx+0xe0\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#\n# 0x8415c posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, 0, rsp+0x60, [rax])\n# constraints:\n#   address rsp+0x78 is writable\n#   rsp \u0026 0xf == 0\n#   (u64)xmm0 == NULL || {(u64)xmm0, (u64)xmm1, [rsp+0x70], NULL} is a valid argv\n#   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp\n#   rbx+0xe0 == NULL || writable: rbx+0xe0\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#\n# 0x84162 posix_spawn(rbx+0xe0, \"/bin/sh\", rdx, rcx, rsp+0x60, [rax])\n# constraints:\n#   address rsp+0x78 is writable\n#   rsp \u0026 0xf == 0\n#   (u64)xmm0 == NULL || {(u64)xmm0, (u64)(xmm0 \u003e\u003e 64), [rsp+0x70], NULL} is a valid argv\n#   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp\n#   rbx+0xe0 == NULL || writable: rbx+0xe0\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#   rcx == NULL || (u16)[rcx] == NULL\n#\n# 0x84169 posix_spawn(rdi, \"/bin/sh\", rdx, rcx, rsp+0x60, [rax])\n# constraints:\n#   address rsp+0x78 is writable\n#   rsp \u0026 0xf == 0\n#   (u64)xmm0 == NULL || {(u64)xmm0, (u64)(xmm0 \u003e\u003e 64), [rsp+0x70], NULL} is a valid argv\n#   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp\n#   rdi == NULL || writable: rdi\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#   rcx == NULL || (u16)[rcx] == NULL\n#\n# 0x84170 posix_spawn(rdi, \"/bin/sh\", rdx, rcx, r8, [rax])\n# constraints:\n#   address rsp+0x78 is writable\n#   rsp \u0026 0xf == 0\n#   [r8] == NULL || r8 is a valid argv\n#   [[rax]] == NULL || [rax] == NULL || [rax] is a valid envp\n#   rdi == NULL || writable: rdi\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#   rcx == NULL || (u16)[rcx] == NULL\n#\n# 0xe3afe execve(\"/bin/sh\", r15, r12)\n# constraints:\n#   [r15] == NULL || r15 == NULL || r15 is a valid argv\n#   [r12] == NULL || r12 == NULL || r12 is a valid envp\n#\n# 0xe3b01 execve(\"/bin/sh\", r15, rdx)\n# constraints:\n#   [r15] == NULL || r15 == NULL || r15 is a valid argv\n#   [rdx] == NULL || rdx == NULL || rdx is a valid envp\n#\n# 0xe3b04 execve(\"/bin/sh\", rsi, rdx)\n# constraints:\n#   [rsi] == NULL || rsi == NULL || rsi is a valid argv\n#   [rdx] == NULL || rdx == NULL || rdx is a valid envp\n#\n# 0xe3cf3 execve(\"/bin/sh\", r10, r12)\n# constraints:\n#   address rbp-0x78 is writable\n#   [r10] == NULL || r10 == NULL || r10 is a valid argv\n#   [r12] == NULL || r12 == NULL || r12 is a valid envp\n#\n# 0xe3cf6 execve(\"/bin/sh\", r10, rdx)\n# constraints:\n#   address rbp-0x78 is writable\n#   [r10] == NULL || r10 == NULL || r10 is a valid argv\n#   [rdx] == NULL || rdx == NULL || rdx is a valid envp\n#\n# 0xe3d62 execve(\"/bin/sh\", rbp-0x50, r12)\n# constraints:\n#   address rbp-0x48 is writable\n#   r13 == NULL || {\"/bin/sh\", r13, NULL} is a valid argv\n#   [r12] == NULL || r12 == NULL || r12 is a valid envp\n#\n# 0xe3d69 execve(\"/bin/sh\", rbp-0x50, r12)\n# constraints:\n#   address rbp-0x48 is writable\n#   rax == NULL || {rax, r13, NULL} is a valid argv\n#   [r12] == NULL || r12 == NULL || r12 is a valid envp\n#\n# 0xe3d70 execve(\"/bin/sh\", rbp-0x50, r12)\n# constraints:\n#   address rbp-0x50 is writable\n#   rax == NULL || {rax, [rbp-0x48], NULL} is a valid argv\n#   [r12] == NULL || r12 == NULL || r12 is a valid envp\n#\n# 0xe3da7 execve(\"/bin/sh\", rbp-0x50, r12)\n# constraints:\n#   address rbp-0x50 is writable\n#   [rbp-0x68] == NULL || {\"/bin/sh\", [rbp-0x68], NULL} is a valid argv\n#   [r12] == NULL || r12 == NULL || r12 is a valid envp\n#\n# 0xe3db1 execve(\"/bin/sh\", rbp-0x50, r12)\n# constraints:\n#   address rbp-0x50 is writable\n#   rax == NULL || {rax, [rbp-0x68], NULL} is a valid argv\n#   [r12] == NULL || r12 == NULL || r12 is a valid envp\n#\n# 0xe3db5 execve(\"/bin/sh\", r10, r12)\n# constraints:\n#   addresses r10+0x10, rbp-0x50 are writable\n#   [r10] == NULL || r10 == NULL || r10 is a valid argv\n#   [r12] == NULL || r12 == NULL || r12 is a valid envp\n#\n# 0xe3dbd execve(\"/bin/sh\", r10, r12)\n# constraints:\n#   addresses r10+0x10, rbp-0x48 are writable\n#   [r10] == NULL || r10 == NULL || r10 is a valid argv\n#   [r12] == NULL || r12 == NULL || r12 is a valid envp\n#\n# 0x1077ca posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x38], 0, rsp+0x70, [rsp+0xf0])\n# constraints:\n#   [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv\n#   [[rsp+0xf0]] == NULL || [rsp+0xf0] == NULL || [rsp+0xf0] is a valid envp\n#   [rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] \u003c= 0\n#\n# 0x1077d2 posix_spawn(rsp+0x64, \"/bin/sh\", [rsp+0x38], 0, rsp+0x70, r9)\n# constraints:\n#   [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv\n#   [r9] == NULL || r9 == NULL || r9 is a valid envp\n#   [rsp+0x38] == NULL || (s32)[[rsp+0x38]+0x4] \u003c= 0\n#\n# 0x1077d7 posix_spawn(rsp+0x64, \"/bin/sh\", rdx, 0, rsp+0x70, r9)\n# constraints:\n#   [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv\n#   [r9] == NULL || r9 == NULL || r9 is a valid envp\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n#\n# 0x1077e1 posix_spawn(rdi, \"/bin/sh\", rdx, 0, r8, r9)\n# constraints:\n#   [r8] == NULL || r8 is a valid argv\n#   [r9] == NULL || r9 == NULL || r9 is a valid envp\n#   rdi == NULL || writable: rdi\n#   rdx == NULL || (s32)[rdx+0x4] \u003c= 0\n\n```\n\n#### Other Architectures\n\n##### i386\n```bash\n$ one_gadget /lib32/libc.so.6\n# 0xc890b execve(\"/bin/sh\", [ebp-0x2c], esi)\n# constraints:\n#   address ebp-0x20 is writable\n#   ebx is the GOT address of libc\n#   [[ebp-0x2c]] == NULL || [ebp-0x2c] == NULL || [ebp-0x2c] is a valid argv\n#   [esi] == NULL || esi == NULL || esi is a valid envp\n#\n# 0x1421b3 execl(\"/bin/sh\", eax)\n# constraints:\n#   ebp is the GOT address of libc\n#   eax == NULL\n#\n# 0x1421b4 execl(\"/bin/sh\", [esp])\n# constraints:\n#   ebp is the GOT address of libc\n#   [esp] == NULL\n\n```\n![i386](https://github.com/david942j/one_gadget/blob/master/examples/i386.png?raw=true)\n\n##### AArch64\n```bash\n$ one_gadget spec/data/aarch64-libc-2.27.so\n# 0x3f160 execve(\"/bin/sh\", sp+0x70, environ)\n# constraints:\n#   address x20+0x338 is writable\n#   x3 == NULL\n#\n# 0x3f184 execve(\"/bin/sh\", sp+0x70, environ)\n# constraints:\n#   addresses x19+0x4, x20+0x338 are writable\n#   [sp+0x70] == NULL\n#\n# 0x3f1a8 execve(\"/bin/sh\", x21, environ)\n# constraints:\n#   addresses x19+0x4, x20+0x338 are writable\n#   [x21] == NULL || x21 == NULL\n#\n# 0x63e90 execl(\"/bin/sh\", x1)\n# constraints:\n#   x1 == NULL\n\n```\n![aarch64](https://github.com/david942j/one_gadget/blob/master/examples/aarch64.png?raw=true)\n\n#### Combine with Script\nPass your exploit script as `one_gadget`'s arguments, it can\ntry all gadgets one by one, so you don't need to try every possible gadgets manually.\n\n```bash\n$ one_gadget ./spec/data/libc-2.19.so -s 'echo \"offset -\u003e\"'\n```\n\n![--script](https://github.com/david942j/one_gadget/blob/master/examples/script.png?raw=true)\n\n### In Ruby Scripts\n```ruby\nrequire 'one_gadget'\nOneGadget.gadgets(file: '/lib/x86_64-linux-gnu/libc.so.6')\n#=\u003e [932606, 932609, 932612]\n\n# or in shorter way\none_gadget('/lib/x86_64-linux-gnu/libc.so.6', level: 1)\n#=\u003e [335355, 335362, 335369, 335376, 335381, 335397, 335402, 335405, 335410, 540981, 540988, 540995, 540998, 541003, 541008, 541020, 541026, 541033, 541040, 932606, 932609, 932612, 933107, 933110, 933218, 933225, 933232, 933287, 933297, 933301, 933309, 1079242, 1079250, 1079255, 1079265]\n\n# from build id\none_gadget('b417c0ba7cc5cf06d1d1bed6652cedb9253c60d0')\n#=\u003e [324286, 324293, 324386, 1090444]\n\n```\n\n### To Python Lovers\n```python\nimport subprocess\ndef one_gadget(filename):\n  return [int(i) for i in subprocess.check_output(['one_gadget', '--raw', filename]).decode().split(' ')]\n\none_gadget('/lib/x86_64-linux-gnu/libc.so.6')\n#=\u003e [932606, 932609, 932612]\n\n```\n\n## Make OneGadget Better\nAny suggestion or feature request is welcome! Feel free to send a pull request.\n\nPlease let me know if you find any libc that make OneGadget fail to find gadgets.\nAnd, if you like this work, I'll be happy to be [starred](https://github.com/david942j/one_gadget/stargazers) :grimacing:\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdavid942j%2Fone_gadget","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdavid942j%2Fone_gadget","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdavid942j%2Fone_gadget/lists"}