ROP Search

rop_search.py searches rp++ gadget output for gadgets that contain ordered instruction, register, or value fragments.

It is useful when a ROP chain needs a gadget sequence such as sub esi, 0x20 followed later by push ebx, or when gadget addresses must avoid specific bad characters.

Requirements

• Python 3.10 or newer
• Gadget output generated by rp++

Usage

python3 rop_search.py --file rop.txt --gadgets "sub esi, 0x20" "push ebx"

Short option:

python3 rop_search.py -file rop.txt -g "pop eax" "mov dword [esi+0x04]" "ret"

Exclude addresses containing bad characters:

python3 rop_search.py -file rop.txt -g "sub esi" "push" --badchars "0a,0d,25,26,2b,3d"

Limit results and show address bytes:

python3 rop_search.py -file rop.txt -g "mov eax" "pop esi" --max 20 --show-bytes

Count matches only:

python3 rop_search.py -file rop.txt -g "pop eax" --count-only

Matching Behavior

By default, terms are matched in order across the full gadget text. Terms can be partial instruction fragments.

Use --instruction-order when each term should match a later instruction rather than simply a later substring:

python3 rop_search.py -file rop.txt -g "pop eax" "ret" --instruction-order

Input Format

The script expects rp++ style lines such as:

0x10010101: pop eax ; ret
0x10010202: sub esi, 0x20 ; push ebx ; ret

Lines that do not match this address-and-gadget format are ignored.

License

MIT License. See LICENSE.