regROP v1.0
This is just a simple skeleton python script that allows you to use regular expressions to filter ROP lists that are generated by mona. You can see some sample usages below. Keep in mind that these are just simple searches, you can use the full range of regular expressions to find even the most rare instructions. I have also limited the output below to just a few results. The demo search results come from MSVCR71.dll.
Download: regROP.py
root@Trident:~/Desktop# ./regROP.py raw_rop.txt 'PUSH ESP.+POP' 0x7c372f4f : # PUSH ESP # AND AL,10 # MOV DWORD PTR DS:[EDX],ECX # POP ESI # RETN 0x7c34969e : # PUSH ESP # MOV AL,BYTE PTR DS:[C68B7C37] # POP ESI # POP EBX # RETN 0x7c37591f : # PUSH ESP # ADD CH,BL # INC EBP # OR AL,59 # POP ECX # POP EBP # RETN [...Snip...] root@Trident:~/Desktop# ./regROP.py raw_rop.txt 'ADD ESP,..\s#' 0x7c352007 : # ADD ESP,0C # RETN 0x7c352041 : # ADD ESP,0C # RETN 0x7c35f9a0 : # ADD ESP,2C # RETN 0x7c35207e : # ADD ESP,0C # RETN 0x7c3520bd : # ADD ESP,0C # RETN 0x7c3440be : # ADD ESP,14 # RETN [...Snip...] root@Trident:~/Desktop# ./regROP.py raw_rop.txt 'MOV\s\w+,DWORD PTR DS:\[EAX\]' 0x7c3530ea : # MOV EAX,DWORD PTR DS:[EAX] # RETN 0x7c3413aa : # MOV EAX,DWORD PTR DS:[EAX] # PUSH EAX # RETN 0x7c35a000 : # MOV EAX,DWORD PTR DS:[EAX] # ADD EAX,ECX # RETN 0x7c359fff : # POP ESI # MOV EAX,DWORD PTR DS:[EAX] # ADD EAX,ECX # RETN [...Snip...] root@Trident:~/Desktop# ./regROP.py raw_rop.txt 'XCHG' 0x7c348b05 : # XCHG EAX,ESP # RETN 0x7c36c652 : # XCHG EAX,EDI # PUSH ESP # STD # DEC ECX # RETN 0x7c341cae : # XCHG EAX,ESP # PUSH ES # ADD BYTE PTR DS:[EAX],AL # RETN 0x7c3413a9 : # XCHG EAX,ESP # MOV EAX,DWORD PTR DS:[EAX] # PUSH EAX # RETN 0x7c342643 : # XCHG EAX,ESP # POP EDI # ADD BYTE PTR DS:[EAX],AL # POP ECX # RETN [...Snip...] root@Trident:~/Desktop# ./regROP.py raw_rop.txt 'KERNEL' 0x7c355c63 : # ADC EAX,<&KERNEL32.Beep> # RETN 0x7c355c54 : # ADC EAX,<&KERNEL32.Sleep> # RETN 0x7c341a0f : # ADC EAX,<&KERNEL32.TlsAlloc> # RETN 0x7c35f575 : # ADC EAX,<&KERNEL32.LoadLibraryA> # RETN 0x7c355c61 : # OR BH,BH # ADC EAX,<&KERNEL32.Beep> # RETN 0x7c34ade7 : # ADC EAX,<&KERNEL32.HeapFree> # POP ESI # RETN 0x7c341a0d : # ADD BH,BH # ADC EAX,<&KERNEL32.TlsAlloc> # RETN [...Snip...] root@Trident:~/Desktop# ./regROP.py raw_rop.txt 'POP.+POP.+POP' 0x7c374011 : # POP ECX # POP ESI # POP EBP # RETN 0x7c37606c : # POP EDI # POP ESI # POP EBX # RETN 0x7c3660e2 : # POP EDI # POP ESI # POP EBX # RETN 0x7c3761a5 : # POP EDI # POP ESI # POP EBX # RETN 0x7c342301 : # POP EDI # POP ESI # POP EBP # RETN 0x7c35437b : # POP EDI # POP ESI # POP EBP # RETN 0x7c350389 : # POP ESI # POP EBX # POP EBP # RETN [...Snip...] root@Trident:~/Desktop# ./regROP.py raw_rop.txt 'XOR\sEAX,EAX.+INC\sEAX' 0x7c364045 : # XOR EAX,EAX # INC EAX # RETN 0x7c364071 : # XOR EAX,EAX # INC EAX # RETN 0x7c358077 : # XOR EAX,EAX # INC EAX # RETN 0x7c36409d : # XOR EAX,EAX # INC EAX # RETN 0x7c3480c1 : # XOR EAX,EAX # INC EAX # RETN 0x7c3640e7 : # XOR EAX,EAX # INC EAX # RETN 0x7c34810b : # XOR EAX,EAX # INC EAX # RETN 0x7c354146 : # XOR EAX,EAX # INC EAX # RETN [...Snip...]