Kernel ROP Generator

September 22, 2025 ยท View on GitHub

Description

Tools for generating ROP chains on Linux Kernel images.

angrop_rop_generator.py works by patching the binary (using rop_instruction_patcher.py) to replace the various thunks and runtime patches. These thunks are replaced with nops or invalid instructions to avoid them being identified as possible gadgets. Calls to __x86_return_thunk are replaced with ret so that angrop/rp++ can find gadgets correctly

Usage

  1. Generate ROP chain with angrop_rop_generator.py
    • python angrop_rop_generator.py <vmlinux path> <vmlinuz path>
    • <vmlinux image> needs to include symbols
    • outputs the generated ROP chain

Testing

To test the generated ROP chain, we patch the following syscalls

  • Patch __sys_shutdown to copy ROP chain from user to kernel memory
  • Patch __x64_sys_reboot to jump to the ROP chain
  • Run python kernel_syscall_patcher.py <vmlinux path>
  • This outputs <vmlinux>.syscall_patched

Copy the generated ROP chain into rop_test_trigger.c

  • Compile gcc -static -o rop_test_trigger rop_test_trigger.c
  • cp rop_test_trigger <image_runner path>/rootfs/
  • Run the patched vmlinux in QEMU ./run_vmlinuz.sh <vmlinux>.syscall_patched sh
  • Inside QEMU run ./rop_test_trigger