{"action":"created","issue":{"url":"https://api.github.com/repos/binjitsu/binjitsu/issues/37","labels_url":"https://api.github.com/repos/binjitsu/binjitsu/issues/37/labels{/name}","comments_url":"https://api.github.com/repos/binjitsu/binjitsu/issues/37/comments","events_url":"https://api.github.com/repos/binjitsu/binjitsu/issues/37/events","html_url":"https://github.com/binjitsu/binjitsu/issues/37","id":89575405,"number":37,"title":"i386 ROP bug: Set ESP","user":{"login":"zachriggle","id":111640,"avatar_url":"https://avatars.githubusercontent.com/u/111640?v=3","gravatar_id":"","url":"https://api.github.com/users/zachriggle","html_url":"https://github.com/zachriggle","followers_url":"https://api.github.com/users/zachriggle/followers","following_url":"https://api.github.com/users/zachriggle/following{/other_user}","gists_url":"https://api.github.com/users/zachriggle/gists{/gist_id}","starred_url":"https://api.github.com/users/zachriggle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zachriggle/subscriptions","organizations_url":"https://api.github.com/users/zachriggle/orgs","repos_url":"https://api.github.com/users/zachriggle/repos","events_url":"https://api.github.com/users/zachriggle/events{/privacy}","received_events_url":"https://api.github.com/users/zachriggle/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/binjitsu/binjitsu/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"lieanu","id":3104641,"avatar_url":"https://avatars.githubusercontent.com/u/3104641?v=3","gravatar_id":"","url":"https://api.github.com/users/lieanu","html_url":"https://github.com/lieanu","followers_url":"https://api.github.com/users/lieanu/followers","following_url":"https://api.github.com/users/lieanu/following{/other_user}","gists_url":"https://api.github.com/users/lieanu/gists{/gist_id}","starred_url":"https://api.github.com/users/lieanu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lieanu/subscriptions","organizations_url":"https://api.github.com/users/lieanu/orgs","repos_url":"https://api.github.com/users/lieanu/repos","events_url":"https://api.github.com/users/lieanu/events{/privacy}","received_events_url":"https://api.github.com/users/lieanu/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2015-06-19T14:16:19Z","updated_at":"2015-06-22T02:21:07Z","closed_at":null,"body":"This one might be hard to reason about, but is a common thing for migrating the stack to a different location.\r\n\r\n```\r\ncontext.clear(arch='i386')\r\nrop = ROP(ELF.from_assembly(\r\nshellcraft.read(0, 'esp', 0x1000) +\r\n'''\r\npop esp; ret\r\n'''\r\n))\r\n\r\ncontext = {\r\n    'esp': 0,\r\n}\r\n\r\nfor r, gadgets in rop.setRegisters(context).items():\r\n    for g in gadgets:\r\n        if isinstance(g, pwnlib.rop.gadgets.Gadget): \r\n            print hex(g.address), '; '.join(g.insns)\r\n        elif isinstance(g, int): \r\n            print hex(g)\r\n        else: \r\n            print g\r\n```"},"comment":{"url":"https://api.github.com/repos/binjitsu/binjitsu/issues/comments/113982768","html_url":"https://github.com/binjitsu/binjitsu/issues/37#issuecomment-113982768","issue_url":"https://api.github.com/repos/binjitsu/binjitsu/issues/37","id":113982768,"user":{"login":"zachriggle","id":111640,"avatar_url":"https://avatars.githubusercontent.com/u/111640?v=3","gravatar_id":"","url":"https://api.github.com/users/zachriggle","html_url":"https://github.com/zachriggle","followers_url":"https://api.github.com/users/zachriggle/followers","following_url":"https://api.github.com/users/zachriggle/following{/other_user}","gists_url":"https://api.github.com/users/zachriggle/gists{/gist_id}","starred_url":"https://api.github.com/users/zachriggle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zachriggle/subscriptions","organizations_url":"https://api.github.com/users/zachriggle/orgs","repos_url":"https://api.github.com/users/zachriggle/repos","events_url":"https://api.github.com/users/zachriggle/events{/privacy}","received_events_url":"https://api.github.com/users/zachriggle/received_events","type":"User","site_admin":false},"created_at":"2015-06-22T02:21:07Z","updated_at":"2015-06-22T02:21:07Z","body":"For the `pop esp` case, we want to directly fill esp with the value.  It might be a good idea to just add `context.bytes` to the value we're setting it to.  The effect we're trying to achieve is that, at the next `ret`, `esp=0`.  What we have right now is that `esp=0` *after* the ret.  It's doing exactly what we're asking, which is fine -- but we can also make it do what the user expects by just adding a little bit to it."}}