ropgadget

Find gadgets in binary

$ ROPgadget --binary [binary]

$ ROPgadget --binary [binary] --string "[/bin/sh]"

$ ROPgadget --binary [binary] --re "[pop.*ret]"

$ ROPgadget --binary [binary] --nojop

$ ROPgadget --binary [binary] --depth [5]

$ ROPgadget --binary [binary] --ropchain

$ ROPgadget --binary [binary] > [gadgets.txt]

ROPgadget [--binary file] [--string str] [--re pattern] [options]

ROPgadget finds ROP (Return-Oriented Programming) gadgets in binaries. It's used for exploit development and security research.
Gadgets are small instruction sequences ending in returns. They're chained to build exploits.
String searching finds useful data in binaries. Shell paths and other strings located.
Automatic ropchain generation builds exploit templates. Creates execve chains for common scenarios.
Depth limits instruction sequence length. Shorter gadgets are generally more useful.

--binary FILE

Target binary.

Find string in binary.

Filter by regex.

Generate ROP chain.

Gadget instruction depth.

No JOP gadgets.

No syscall gadgets.

Multiple branches.

All sections.

For authorized security research only. Understanding assembly required. Results need manual analysis.

ROPgadget was created by Jonathan Salwan for ROP exploit development. It's widely used in CTF competitions and security research.

ropper(1), objdump(1), pwntools(1), radare2(1)