Ghidra scripts to support IOT exploitation. Some of the scripts are a port of devttyS0 IDA plugins and others are new scripts that I found a need for. To install, clone and add the script directory via Ghidra's Script Manager. If you check the 'In Tool' checkbox they will appear under a 'TNS' tag.

Scripts

Below is a simple overview of the available scripts. If the scripts are broken up into multiple parts then bullets are given with high level overviews. Click on the link for each to see a more in-depth explanation with screenshots.

ARM ROP Finder

Script to find and support finding ARM ROP gadgets.

• Gadgets

  • Find double jumps.
  • Move small value to r0.
  • Get control of more or different registers.
  • Move values between registers.
  • Find strings or shellcode on the stack.
  • Find custom gadgets based on regular expressions.
  • Gadgets to call system with a string argument in r0.

• Support

  • Convert entire program to Thumb instructions.
  • List summary of saved gadgets.

Call Chain

Find call chains between two user specified functions. Results are displayed in a png.

Codatify

• Fixup code - defines all undefined data in the .text section as code and creates a function if it can.
• Fixup data - define uninitialized strings and pointers. Searches for function tables and renames functions based on their discovery.

Fluorescence

Highlight function calls.

Function Profiler

Display cross refs from the current function.

Leaf Blower

• Format Strings - Find functions that accept format strings as parameters.
• Leaf Functions - Identify potential leaf functions such as strcpy, strlen, etc.

Local Cross References

Find references to items in the current function.

MIPS ROP Finder

Scripts to find and support finding MIPS ROP gadgets.

• Gadgets

  • Double Jumps
  • Epilogue
  • Find custom gadgets
  • Indirect Return
  • li a0
  • Prologue
  • System Gadgets

• Chain Builder

  • Build ROP chain to call shellcode
  • Build ROP chain to call system with controllable string.

• Support

  • Summary

Operator

Display all calls to a function and identify the source of the parameters it is called with taking variadic arguments into account if they are present.

Rename Variables

Rename saved stack variables. (MIPS only)

Rizzo

Create fuzzy function signatures that can be applied to other projects.