security enabled verified low v1.0.0

ropgadget

Tool for finding ROP (Return-Oriented Programming) gadgets in binaries for building ROP chains.

📋 Live Preview

ROPgadget --binary {binary}

🌍 binary →

ROPgadget --binary {binary}

Sandbox: execFile · Timeout: 300s

Capabilities

rop.gadget.find

binary.analysis

exploit.development

Parameters

Name	Type	Required	Default	Description	Aliases
`binary`	string	No	-	Binary file to analyze for gadgets	`--binary`
`rawArch`	string	No	-	Raw architecture (e.g., x86, arm, mips)	`--rawArch`
`rawMode`	string	No	-	Raw mode (e.g., 32, 64)	`--rawMode`
`opcode`	string	No	-	Only search for specific opcodes	`--opcode`
`all`	boolean	No	-	Show all gadgets (not just unique)	`--all`
`badbytes`	string	No	-	Bytes to exclude from gadgets	`--badbytes`
`depth`	integer	No	-	Maximum gadget depth in instructions	`--depth`
`thumb`	boolean	No	-	Use ARM Thumb mode	`--thumb`
`json`	boolean	No	-	Output in JSON format	`--json`
`console`	boolean	No	-	Use interactive console	`--console`
`nojop`	boolean	No	-	exclude JOP gadgets	`--nojop`
`nosys`	boolean	No	-	exclude SYS gadgets	`--nosys`
`output`	string	No	-	Write results to file	`--output`
`range`	string	No	-	Limit search to address range start-end	`--range`
`rawEndian`	boolean	No	-	set endianness (big/little)	`--rawEndian`
`rawVendor`	boolean	No	-	set CPU vendor	`--rawVendor`

Contract

Inputs

file.binary

Binary to search for gadgets

Outputs

rop.gadget.list

List of ROP gadgets found

rop.gadget.json

ROP gadgets in JSON format

Side effects:

Workflow Edges

Produces

rop.gadget.listrop.gadget.json

Consumes

file.binary

Resource Profile

Resource	Value
CPU	medium
Memory	256 MB
Network	low
Disk I/O	low

Examples

Find all gadgets in a binary

ROPgadget --binary /bin/ls

Filter gadgets excluding bad bytes

ROPgadget --binary /bin/ls --badbytes 0a

Raw mode gadget search for ARM

ROPgadget --rawArch arm --rawMode 32 --binary firmware.bin

Output gadgets as JSON

ROPgadget --binary /bin/ls --json

Search for specific opcodes

ROPgadget --binary /bin/ls --opcode c3

Documentation

ROPgadget — ROP Gadget Finder

ROPgadget scans executables and libraries to find useful gadgets for Return-Oriented Programming (ROP) exploits. It supports ELF, PE, Mach-O, and raw binary formats across multiple architectures.

Example Output

0x0000000000410ff3 : add byte ptr [rax], al ; jmp 0x410ff0
0x0000000000411dbf : pop rax ; ret
0x0000000000411dc0 : pop rdi ; ret
0x0000000000411dc2 : pop rsi ; ret
0x0000000000411dc4 : pop rdx ; ret

Usage Tips

Use --badbytes to filter out gadgets containing null bytes or newlines
Combine with pwntools' ROP() class for automated chain building
Use --depth to find longer gadget sequences

Related Tools

pwntoolspwndbgropper