Skip to content

Feat/ropbot #136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
Kyle-Kyle wants to merge 262 commits into
base: master
Choose a base branch
from
Open

Feat/ropbot #136

Kyle-Kyle wants to merge 262 commits into from

Conversation

@Kyle-Kyle
Copy link
Collaborator

@Kyle-Kyle Kyle-Kyle commented Dec 29, 2025 •
edited
Loading

This was referenced Dec 29, 2025
Open
Open
@Kyle-Kyle
shortcut reg_setter.optimize so we don't normalize every non-self-con…
56a0910 
…tained gadget
@Kyle-Kyle
ignore constant memory accesses that we know for sure are valid
89b9681
@Kyle-Kyle
add/sub should be considered moves as well
0335edb
@Kyle-Kyle
respect the preserve_regs argument in gadget normalization
eff70bb
@Kyle-Kyle
normalize jmp_reg gadgets
c21d5c4
@Kyle-Kyle
try to shorten chains when doing reg_setter optimization
da1e266
@Kyle-Kyle
capture clobbered_regs side-effect in reg_setter graph building
7441c30
@Kyle-Kyle
support modifable_memory_range for giga_graph_search
d0754b1
@Kyle-Kyle
reduce the graph for performance purpose
b84d00f
@Kyle-Kyle
introduce pop_equal_set to avoid some wrong edges in the graph
b786382
@Kyle-Kyle
try to find chains with smallest stack_change using reg_moves as well
08c1984
@Kyle-Kyle
expand simple rop_blocks to allow reuse
3e2f385
@Kyle-Kyle
correctly reverse Extract
837fb9a
@Kyle-Kyle
oops
df16d4e
@Kyle-Kyle
draft of conditional branch support in giga graph search
52eb11c
@Kyle-Kyle
only normalize a gadget at most once
d276429
@Kyle-Kyle
make conditional branch normalization compatible with transit_type no…
56fdf16 
…rmalization
@Kyle-Kyle
don't normalize gadgets that have symbolic accesses
d39e7a6
@Kyle-Kyle
if two gadgets having the same effect, drop the one with conditional_…
3b01149 
…branch
@Kyle-Kyle
well, jmp_mem gadgets inherently have symbolic access, we monkey-patc…
57b2c55 
…h this situation
@Kyle-Kyle
use a greedy algorithm in reg_setter graph building and a cutoff in o…
c89a025 
…rder to avoid wasting a lot of resources in finding useless paths
@Kyle-Kyle
normalize call gadgets correctly
9bc1563
@Kyle-Kyle
no need to pass stack_change to _build_reg_setting_chain, it should b…
62b6a76 
…e inferred from the gadget list
@Kyle-Kyle
try to use the minimal stack shifter
ebf9308
@Kyle-Kyle
ignore jmp_reg gadgets that do gadget arithmetic for now
1f71023
@Kyle-Kyle
better support jmp_mem gadget normalization
3c3d050
@Kyle-Kyle
allow pre/post_preserve register list during gadget normalization
af281c9
@Kyle-Kyle
testcase for rex prefix
fcf39b9
@angr-bot
Copy link
Member

angr-bot commented Dec 29, 2025

Corpus decompilation diffs can be found at angr/dec-snapshots@master...angr/angrop_136

@Kyle-Kyle Kyle-Kyle force-pushed the feat/ropbot branch 3 times, most recently from 7d0c6c2 to 6a30d9d Compare January 5, 2026 06:42
@Kyle-Kyle Kyle-Kyle force-pushed the feat/ropbot branch 2 times, most recently from 32e96df to 76b6a11 Compare January 6, 2026 06:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@Kyle-Kyle @angr-bot @salls @dfraze