{"action":"created","issue":{"url":"https://api.github.com/repos/JonathanSalwan/ROPgadget/issues/73","labels_url":"https://api.github.com/repos/JonathanSalwan/ROPgadget/issues/73/labels{/name}","comments_url":"https://api.github.com/repos/JonathanSalwan/ROPgadget/issues/73/comments","events_url":"https://api.github.com/repos/JonathanSalwan/ROPgadget/issues/73/events","html_url":"https://github.com/JonathanSalwan/ROPgadget/issues/73","id":74957439,"number":73,"title":"Looking for \"int 0x80 ; ret\" instruction","user":{"login":"eQu1NoX","id":1166616,"avatar_url":"https://avatars.githubusercontent.com/u/1166616?v=3","gravatar_id":"","url":"https://api.github.com/users/eQu1NoX","html_url":"https://github.com/eQu1NoX","followers_url":"https://api.github.com/users/eQu1NoX/followers","following_url":"https://api.github.com/users/eQu1NoX/following{/other_user}","gists_url":"https://api.github.com/users/eQu1NoX/gists{/gist_id}","starred_url":"https://api.github.com/users/eQu1NoX/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eQu1NoX/subscriptions","organizations_url":"https://api.github.com/users/eQu1NoX/orgs","repos_url":"https://api.github.com/users/eQu1NoX/repos","events_url":"https://api.github.com/users/eQu1NoX/events{/privacy}","received_events_url":"https://api.github.com/users/eQu1NoX/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-05-10T16:55:58Z","updated_at":"2015-05-28T19:49:29Z","closed_at":"2015-05-10T18:30:24Z","body":"Would it be possible to look for a syscall/int 0x80 instruction followed by a ret? Does ROPgadget already do this?"},"comment":{"url":"https://api.github.com/repos/JonathanSalwan/ROPgadget/issues/comments/106577479","html_url":"https://github.com/JonathanSalwan/ROPgadget/issues/73#issuecomment-106577479","issue_url":"https://api.github.com/repos/JonathanSalwan/ROPgadget/issues/73","id":106577479,"user":{"login":"zachriggle","id":111640,"avatar_url":"https://avatars.githubusercontent.com/u/111640?v=3","gravatar_id":"","url":"https://api.github.com/users/zachriggle","html_url":"https://github.com/zachriggle","followers_url":"https://api.github.com/users/zachriggle/followers","following_url":"https://api.github.com/users/zachriggle/following{/other_user}","gists_url":"https://api.github.com/users/zachriggle/gists{/gist_id}","starred_url":"https://api.github.com/users/zachriggle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zachriggle/subscriptions","organizations_url":"https://api.github.com/users/zachriggle/orgs","repos_url":"https://api.github.com/users/zachriggle/repos","events_url":"https://api.github.com/users/zachriggle/events{/privacy}","received_events_url":"https://api.github.com/users/zachriggle/received_events","type":"User","site_admin":false},"created_at":"2015-05-28T19:49:29Z","updated_at":"2015-05-28T19:49:29Z","body":"@JonathanSalwan the interesting gadget that it doesn't find is in the VDSO.  Specifically these two sequences (or similar ones).\r\n\r\n## 32-bit\r\n\r\n```\r\n.text:FFFFE42E CD 80                   int     80h \r\n.text:FFFFE430 5D                      pop     ebp\r\n.text:FFFFE431 5A                      pop     edx\r\n.text:FFFFE432 59                      pop     ecx\r\n.text:FFFFE433 C3                      retn\r\n```\r\n\r\n## 64-bit\r\n\r\n```\r\n.text:FFFFFFFFFF700D9A 0F 05                                   syscall\r\n.text:FFFFFFFFFF700D9C\r\n.text:FFFFFFFFFF700D9C                         loc_FFFFFFFFFF700D9C:                   ; CODE XREF: gettimeofday+F6\u0018j\r\n.text:FFFFFFFFFF700D9C 48 83 C4 14                             add     rsp, 14h\r\n.text:FFFFFFFFFF700DA0 5B                                      pop     rbx\r\n.text:FFFFFFFFFF700DA1 41 5C                                   pop     r12\r\n.text:FFFFFFFFFF700DA3 41 5D                                   pop     r13\r\n.text:FFFFFFFFFF700DA5 41 5E                                   pop     r14\r\n.text:FFFFFFFFFF700DA7 41 5F                                   pop     r15\r\n.text:FFFFFFFFFF700DA9 5D                                      pop     rbp\r\n.text:FFFFFFFFFF700DAA C3                                      retn\r\n```"}}