Module: OneGadget::Fetchers::CandidateWalk

Included in:
Base
Defined in:
lib/one_gadget/fetchers/candidate_walk.rb

Overview

Where a gadget could start: a backward control-flow walk from each terminal call, yielding every instruction sequence that reaches it. A conditional branch on the way is explored both ways and its decision becomes a constraint on the candidate, bounded so a loop-heavy region cannot fork forever. Mixed into Base.

Constant Summary collapse

MAX_FORKS =

Give up on a control-flow path once it has crossed this many conditional branches.

4
PATH_BUDGET =

Hard cap on a single path's length (loop/runaway guard).

80

Instance Method Summary collapse

Instance Method Details

#candidates {|cand| ... } ⇒ Array<String>

Fetch candidates that end with call exec*.

Provide a block to filter gadget candidates.

Yield Parameters:

  • cand (String) —

    Is this candidate valid?

Yield Returns:

  • (Boolean) —

    True for valid.

Returns:

  • (Array<String>) —

    Each String returned is multi-lines of assembly code.



26
27
28
 
# File 'lib/one_gadget/fetchers/candidate_walk.rb', line 26

def candidates(&)
  branch_aware_candidates(&)
end