0verflowme/angrop

angrop is a security tool that automatically finds and assembles "ROP chains", sequences of tiny code fragments reused from existing programs, which security researchers use to exploit memory vulnerabilities. In plain terms, it takes a program, hunts for useful scraps of code already baked into that program, and stitches them together to perform actions the program's authors never intended. It can build these chains, especially long ones, faster than a human could. Under the hood, it rides on top of angr, a broader program-analysis engine. Rather than simply pattern-matching for code snippets, it uses "symbolic execution", a technique that models what a piece of code does under different inputs, and constraint solving to reason about each gadget's effects. For every fragment it finds, it records details like which registers change, what depends on what, and how the stack shifts. That rich metadata lets it chain fragments intelligently rather than guessing. The typical user is a security researcher or a participant in capture-the-flag (CTF) competitions. Concrete use cases include setting CPU registers to specific values, writing data to memory (like the string "/bin/sh" needed to spawn a shell), calling program functions, or adding values to memory locations. You can even concatenate operations: write a file path to memory, open that file, and read its contents, all in one generated payload. The output is copy-paste-ready code for your exploit. One notable tradeoff: because it relies on angr's architecture support, it theoretically works across many platforms, but the README notes that segment analysis for finding executable addresses often breaks on non-ELF binaries like Windows PE files or kernel modules. It's also still actively developed, planned improvements include built-in open/read/write chains for CTFs and support for symbolic values, which would make it more flexible for advanced users.