<commit_before>---
layout: post
title: GSOC2015 Community Bonding Week 01
catagories: [gsoc2015]
tags: [gsoc2015, pwn]
---

> week sync 01

Last week:
* Read most of the barf's codes, Github: [](https://github.com/programa-stic/barf-project).
* Read the papers about the BARF project, REIL intermediate language, and Q: Exploit Hardening Made Easy
    1. [BARF: A multiplatform open source Binary Analysis and Reverse engineering Framework](https://github.com/programa-stic/barf-project/blob/master/documentation/papers/barf.pdf)
    2. [REIL: A platform-independent intermediate representation of disassembled code for static code analysis](http://static.googleusercontent.com/media/www.zynamics.com/en//downloads/csw09.pdf)
    3. [Q: Exploit Hardening Made Easy](http://users.ece.cmu.edu/~ejschwar/papers/usenix11.pdf)

* Submited a pacth for BARF project, URL: [](https://github.com/programa-stic/barf-project/pull/11).
* Done a simple x86 ROP implementation.
* Coding for x64 now.

Next week:
* Do some ARM ROP examples, [](https://github.com/binjitsu/examples/issues/2).
* Continue coding for x64 ROP.

There is  a problem for BARF project. While finding gadgets in large libraries, the efficiency is a problem. I compared three gadget tools(rop-tool, ROPgadget, BARFgadget):

`rop-tools`(written in `c`):
1229 gadgets found.
rop-tool gadget libc.so.6  **17.29s** user 0.01s system 100% cpu 17.289 total

`ROPgadget`:
Unique gadgets found: 21240
ROPgadget --binary libc.so.6  **72.30s** user 10.25s system 99% cpu 1:22.82 total

`BARFgadget`:
           
*           Find Stage :  **358.472s**
* Classification Stage :  854.280s
*   Verification Stage :  377.223s
*                Total : **1589.976s**

[](https://github.com/programa-stic/barf-project/issues/15)

Here is presentation for my classmates in tsinghua university NISL lab, it is in chinese, sorry for that.

[Automate ROP - 基于BARF的ROP链自动生成]({{site.baseurl}}/presentations/automate_rop.html)
<commit_msg>fix all<commit_after>---
layout: post
title: GSOC2015 Community Bonding Week 01
catagories: [gsoc2015]
tags: [gsoc2015, pwn]
---

> week sync 01

Last week:

* Read most of the barf's codes
    * Github: [https://github.com/programa-stic/barf-project](https://github.com/programa-stic/barf-project).
* Read the papers about the BARF project, REIL intermediate language, and Q: Exploit Hardening Made Easy

    * [BARF: A multiplatform open source Binary Analysis and Reverse engineering Framework](https://github.com/programa-stic/barf-project/blob/master/documentation/papers/barf.pdf)
    * [REIL: A platform-independent intermediate representation of disassembled code for static code analysis](http://static.googleusercontent.com/media/www.zynamics.com/en//downloads/csw09.pdf)
    * [Q: Exploit Hardening Made Easy](http://users.ece.cmu.edu/~ejschwar/papers/usenix11.pdf)

* Submited a pacth for BARF project
    * [https://github.com/programa-stic/barf-project/pull/11](https://github.com/programa-stic/barf-project/pull/11).
* Done a simple x86 ROP implementation.
* Coding for x64 now.

Next week:

* Do some ARM ROP examples
    * [https://github.com/binjitsu/examples/issues/2](https://github.com/binjitsu/examples/issues/2).
* Continue coding for x64 ROP.

There is  a problem for BARF project. While finding gadgets in large libraries, the efficiency is a problem. I compared three gadget tools(rop-tool, ROPgadget, BARFgadget):

`rop-tools`(written in `c`):

1229 gadgets found.

rop-tool gadget libc.so.6  **17.29s** user 0.01s system 100% cpu 17.289 total

`ROPgadget`:

Unique gadgets found: 21240

ROPgadget --binary libc.so.6  **72.30s** user 10.25s system 99% cpu 1:22.82 total

`BARFgadget`:

*           Find Stage :  **358.472s**
* Classification Stage :  854.280s
*   Verification Stage :  377.223s
*                Total : **1589.976s**


Open issus: [https://github.com/programa-stic/barf-project/issues/15](https://github.com/programa-stic/barf-project/issues/15).

Here is presentation for my classmates in tsinghua university NISL lab, it is in chinese, sorry for that.

[Automate ROP - 基于BARF的ROP链自动生成]({{site.baseurl}}/presentations/automate_rop.html)

{'fraction_non_alphanumeric': 0.12346570397111914, 'fraction_numerical': 0.04861612515042118, 'mean_word_length': 3.9891956782713085, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 14, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1458187', 'n_tokens_mistral': 1597, 'n_tokens_neox': 1399, 'n_words': 393}