ropop.py

#!/usr/bin/python
import capstone
import re
import sys
from ptrace.debugger import *
from capstone import *

class Page():
    def __init__(self, start, end, flags, name):
        self.start = int(start, 16)
        self.end = int(end, 16)
        self.flags = str(flags)
        self.name = str(name)
        self.size = self.end - self.start


class Ropop():
    def __init__(self, pid):
        self.pid = int(pid)
        self.pages = []
        self.hmaps = open('/proc/' + str(self.pid) + '/maps', 'rb')
        self.hmem = open('/proc/' + str(self.pid) + '/mem', 'rb')

        self.regexpmaps = re.compile('(?P<start>\w+)-(?P<end>\w+)\s+(?P<flags>[-\w]{4})\s+(\w+)\s+([:\w]+)\s+(\w+)\s+(?P<name>[\W\w]+)$')

        self.ptrace = process.PtraceProcess(debugger.PtraceDebugger(), self.pid, True, False)

        self._maps()

    def _maps(self):
        for page in self.hmaps.readlines():
            p = self.regexpmaps.match(page)
            self.pages.append(Page(p.group('start'), p.group('end'), p.group('flags'), p.group('name')))

    def dump(self, offset, size):
        return self.ptrace.readBytes(offset, size)

    def find_ret(self, name):
        for page in self.pages:
            if name in page.name and re.match('r.x.', page.flags):
                dump = self.dump(page.start, page.size)
                print dump[3]

if __name__=="__main__":
    rop = Ropop(1861)
    rop.find_ret('libc-2.19.so')