Use install.sh to install as 'kropr' without breaking unmodified ropr installation
Prevent scanning executable sections besides .text (e.g. .init.text for gadgets), they won't be executable at runtime. Cuts down on false positives.
Change 'sys' gadgets to not include syscall
or int 0x80
since those are never useful in the kernel, the remaining 'sys' gadgets -- sysret/iret/sysexit -- can be filtered out with '--nosys' as before.
Do not include results with interrupt instructions (e.g. int3).
Find gadgets that end in jmp __x86_return_thunk
, jmp __x86_indirect_thunk_r*
, jmp __x86_indirect_jump_thunk_r*
, jmp __x86_indirect_call_thunk_r*
Made it so that --noisy treats anything ending in a branch/call as a potential gadget, excluding near jumps can mean that when symbols are not available thunked gadgets are not found
Output can be sorted alphabetically via the --sort option
The --magic flag can be used to get some commonly used offsets