> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/bin-exp/tools/ropper.md).

# Ropper

You can use ropper to display information about binary files in different file formats and you can search for gadgets to build rop chains for different architectures (x86/X86\_64, ARM/ARM64, MIPS/MIPS64, PowerPC/PowerPC64, SPARC64). 

## Usage examples

### Search for gadgets

To search for a gadget the POPs RAX and RETurns

```bash
ropper -f <binary> --search "pop rax; ret" 
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/Pwn/Very_Easy_Pwn/Power_Greed/challenge]
└─$ ropper -f power_greed --search "pop rax; ret"                                                  
[INFO] Load gadgets for section: LOAD
[LOAD] loading... 100%
[LOAD] removing double gadgets... 100%
[INFO] Searching for gadgets: pop rax; ret

[INFO] File: power_greed
0x000000000042adab: pop rax; ret; 

```

</details>

To search for gadgets that includeds POP RDI

```bash
ropper -f <binary> --search "pop rdi"
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/Pwn/Very_Easy_Pwn/Power_Greed/challenge]
└─$ ropper -f power_greed --search "pop rdi"     
[INFO] Load gadgets from cache
[LOAD] loading... 100%
[LOAD] removing double gadgets... 100%
[INFO] Searching for gadgets: pop rdi

[INFO] File: power_greed
0x000000000045ee88: pop rdi; add ah, byte ptr [rdx - 0x4e]; and byte ptr [rsi], ah; ret; 
0x00000000004107a1: pop rdi; add dword ptr [rcx + rcx*4 - 0x11], ecx; call qword ptr [rax + 0x18]; 
0x000000000045f7c7: pop rdi; add rax, rdi; shr rax, 2; vzeroupper; ret; 
0x000000000041ff27: pop rdi; add rax, rdi; vzeroupper; ret; 
0x000000000046f9d5: pop rdi; add rdi, 0x21; add rax, rdi; vzeroupper; ret; 
0x00000000004739c5: pop rdi; cmp dword ptr [rcx], eax; add al, ch; idiv dh; jmp qword ptr [rsi - 0x70]; 
0x0000000000455e4b: pop rdi; cmp sil, byte ptr [rdi + rax]; jne 0x55e59; add rax, rdi; vzeroupper; ret; 
0x0000000000468aed: pop rdi; mov bh, 0xfb; jmp qword ptr [rsi + 0x66]; 
0x000000000040f4b2: pop rdi; pop rbp; jmp rax; 
0x0000000000402bd8: pop rdi; pop rbp; ret; 
0x000000000044e81d: pop rdi; nop; add byte ptr [rax], al; cmove rax, rdx; ret; 

```

</details>

By default, Ropper only searches to gadgets consisting of a maximum of 6 instructions. This can be increased with the `--inst-count` parameter

```bash
ropper -f <binary> --search "pop rdx" --inst-count 7
```

To search for **syscall**

```bash
ropper -f <binary> --search "syscall" --inst-count 1
```

### Search for strings

To search for the string `/bin/sh`

```bash
ropper -f <binary> --string "/bin/sh" 
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/Pwn/Very_Easy_Pwn/Power_Greed/challenge]
└─$ ropper -f power_greed --string "/bin/sh" 


Strings
=======

Address     Value    
-------     -----    
0x00481778  /bin/sh

```

</details>

## Usage information

<details>

<summary>ropper -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ ropper -h                                                                                      
usage: ropper [-h] [--help-examples] [-v] [--console] [-f <file> [<file> ...]] [-r] [-a <arch>] [--section <section>] [--string [<string>]] [--hex] [--asm [<asm> [H|S|R] ...]] [--disasm <opcode>]
              [--disassemble-address <address:length>] [-i] [-e] [--imagebase] [-c] [-s] [-S] [--imports] [--symbols] [--set <option>] [--unset <option>] [-I <imagebase>] [-p] [-j <reg>] [--stack-pivot]
              [--inst-count <n bytes>] [--search <regex>] [--quality <quality>] [--opcode <opcode>] [--instructions <instructions>] [--type <type>] [--detailed] [--all] [--cfg-only] [--chain <generator>]
              [-b <badbytes>] [--nocolor] [--clear-cache] [--no-load] [--analyse <quality>] [--semantic constraint] [--count-of-findings <count of gadgets>] [--single]

You can use ropper to display information about binary files in different file formats
    and you can search for gadgets to build rop chains for different architectures

supported filetypes:
  ELF
  PE
  Mach-O
  Raw

supported architectures:
  x86 [x86]
  x86_64 [x86_64]
  MIPS [MIPS, MIPS64]
  ARM/Thumb [ARM, ARMTHUMB]
  ARM64 [ARM64]
  PowerPC [PPC, PPC64]
  SPARC [SPARC64]

available rop chain generators:
  execve (execve[=<cmd>], default /bin/sh) [Linux x86, x86_64]
  mprotect  (mprotect address=0xdeadbeef size=0x10000) [Linux x86, x86_64]
  virtualprotect (virtualprotect address=0xdeadbeef) [Windows x86]

options:
  -h, --help            show this help message and exit
  --help-examples       Print examples
  -v, --version         Print version
  --console             Starts interactive commandline
  -f, --file <file> [<file> ...]
                        The file to load
  -r, --raw             Loads the file as raw file
  -a, --arch <arch>     The architecture of the loaded file
  --section <section>   The data of the this section should be printed
  --string [<string>]   Looks for the string <string> in all data sections
  --hex                 Prints the selected sections in a hex format
  --asm [<asm> [H|S|R] ...]
                        A string to assemble and a format of the output (H=HEX, S=STRING, R=RAW, default: H)
  --disasm <opcode>     Opcode to disassemble (e.g. ffe4, 89c8c3, ...)
  --disassemble-address <address:length>
                        Disassembles instruction at address <address> (0x12345678:L3). The count of instructions to disassemble can be specified (0x....:L...)
  -i, --info            Shows file header [ELF/PE/Mach-O]
  -e                    Shows EntryPoint
  --imagebase           Shows ImageBase [ELF/PE/Mach-O]
  -c, --dllcharacteristics
                        Shows DllCharacteristics [PE]
  -s, --sections        Shows file sections [ELF/PE/Mach-O]
  -S, --segments        Shows file segments [ELF/Mach-O]
  --imports             Shows imports [ELF/PE]
  --symbols             Shows symbols [ELF]
  --set <option>        Sets options. Available options: aslr nx
  --unset <option>      Unsets options. Available options: aslr nx
  -I <imagebase>        Uses this imagebase for gadgets
  -p, --ppr             Searches for 'pop reg; pop reg; ret' instructions [only x86/x86_64]
  -j, --jmp <reg>       Searches for 'jmp reg' instructions (-j reg[,reg...]) [only x86/x86_64]
  --stack-pivot         Prints all stack pivot gadgets
  --inst-count <n bytes>
                        Specifies the max count of instructions in a gadget (default: 6)
  --search <regex>      Searches for gadgets
  --quality <quality>   The quality for gadgets which are found by search (1 = best)
  --opcode <opcode>     Searches for opcodes (e.g. ffe4 or ffe? or ff??)
  --instructions <instructions>
                        Searches for instructions (e.g. "jmp esp", "pop eax; ret")
  --type <type>         Sets the type of gadgets [rop, jop, sys, all] (default: all)
  --detailed            Prints gadgets more detailed
  --all                 Does not remove duplicate gadgets
  --cfg-only            Filters out gadgets which fail the Microsoft CFG check. Only for PE files which are compiled with CFG check enabled (check DllCharachteristics) [PE]
  --chain <generator>   Generates a ropchain [generator parameter=value[ parameter=value]]
  -b, --badbytes <badbytes>
                        Set bytes which should not contains in gadgets
  --nocolor             Disables colored output
  --clear-cache         Clears the cache
  --no-load             Don't load the gadgets automatically when start the console (--console)
  --analyse <quality>   just used for the implementation of semantic search
  --semantic constraint
                        semantic search for gadgets
  --count-of-findings <count of gadgets>
                        Max count of gadgets which will be printed with semantic search (0 = undefined, default: 5)
  --single              No multiple processes are used for gadget scanning

```

</details>

## Resources

Ropper - GitHub: <https://github.com/sashs/Ropper>

Ropper - Kali Linux: <https://www.kali.org/tools/ropper/>