Module: OneGadget::Fetchers::Disassembly

Included in:

Base

Defined in:

lib/one_gadget/fetchers/disassembly.rb

Overview

Reading the target file: where its terminal calls are, and the disassembly around them. Disassembling a whole libc is the dominant cost of a search, so an architecture that can find its call sites cheaply gets windows around them instead (see Base#scan_calls), and everything derived from one objdump command is cached. Mixed into Base.

Constant Summary

TERMINAL_PREFIXES =

What a terminal function's name starts with. Read by OneGadget::Fetchers::DynamicSymbols too, which finds the same functions by another route.

%w[exec posix_spawn].freeze

TERMINAL_SPAWN =

A call to posix_spawn itself, not one of the setup helpers that share its prefix. The name ends at the version marker, or at the closing bracket when there is none -- glibc's symbols are versioned, musl's are not, and neither is one recovered from a file with no symbol table (see OneGadget::Fetchers::DynamicSymbols).

/posix_spawn[@>]/

WINDOW_BACK =

How much to disassemble around each terminal call when an architecture can locate the calls cheaply (see #terminal_call_sites / #windowed_disasm).

Measured against a full disassembly of every fixture: 0x368 back and 0x350 forward is the least that reports the same gadgets. Both must stay a multiple of four -- objdump decodes from wherever it is told to start, so an offset landing mid-instruction turns the whole window into rubble rather than shifting it.

0x1000

WINDOW_FWD =

As far past the call, for a predecessor that branches back into the region.

0x1000