Support for rebasing cached gadgets

[chase1k]

Description

When attempting to load gadgets from a saved gadget file from an ASLR enabled binary such as libc.so.6, angrop seems not adjust the loaded gadgets to the provided base_addr.

proj = angr.Project(LIBC_PATH, main_opts={'base_addr': libc_base}, auto_load_libs=False)
rop = proj.analyses.ROP()

if os.path.exists(LIBC_GADGETS):
    print("Loading libc gadgets from:", LIBC_GADGETS)
    rop.load_gadgets(LIBC_GADGETS)
else:
    rop.find_gadgets()
    rop.save_gadgets(LIBC_GADGETS)
    print("Gadgets saved to:", LIBC_GADGETS)

chain = rop.func_call(system_addr, [binsh_addr])
rop = chain.payload_str()

File "/home/chase/venv/lib/python3.12/site-packages/angr/engines/vex/lifter.py", line 245, in lift_vex
  raise SimEngineError(f"No bytes in memory for block starting at {addr:#x}.")
angr.errors.SimEngineError: No bytes in memory for block starting at 0x7bbd264ec973.

Then, when checking what my previous run leaked for the libc base, I had:
Libc: 0x7bbd26400000

Alternatives

No response

Additional context

No response

[Kyle-Kyle]

If I understand correctly, the base_addr you provide is different each time, and you'd like to have an option to rebase the gadgets' base addresses?
I think the correct way to do it is to specify base_addr as 0 and then the generated ROP chain will be something like

rop = b''
rop += p64(code_base + <offset>)

then you provide your code_base as libc_base.

But yeah, I agree this is not intuitive. I might need to add this to the documentation or implement the rebase logic. Actually, maybe we should have base_addr == 0 by default so users don't need to rebase, and it is intuitive to just add the offset.

[chase1k]

Yeah, in my head this should work without needing to manually re-add the offset.
The gadgets should save not relative to any base address, and when loaded then rebased to a specified or default offset. Given a libc/pie base from a leak or the default binary offset for your static executable.

Mainly keeping support for saving gadgets combined with using the rop.func_call() and execve() similar functionality where you're not interacting with each gadget.