david942j/one_gadget

Health v2 · maintenance only

Adoption not part of the score

2346 stars · 149 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Ruby command-line tool that finds one-gadget RCE candidates (execve('/bin/sh',...) call sites) in libc binaries for CTF pwn challenges. It uses backward symbolic execution from exec/posix_spawn calls to derive the constraints each gadget requires, supporting i386, amd64, arm, and aarch64.

Use cases

• find one gadget rce offsets in libc.so.6
• find execve /bin/sh gadgets in glibc for ctf pwn challenges
• get constraints for one_gadget exploitation
• search libc for one-shot shell gadgets without objdump or IDA
• find one_gadget addresses for a given libc binary
• locate execve gadgets in libc for ret2libc exploits

When to choose

• you are solving CTF pwn challenges and need one-gadget RCE offsets quickly
• you want automatically derived constraints for each gadget instead of manual reverse engineering
• you need support for x86, amd64, arm, and aarch64 libc binaries

When to avoid

• you need general ROP gadget search rather than execve-based one gadgets
• you are doing defensive security analysis rather than exploitation
• you need a library API in a language other than Ruby

Facets

cli-tool · maturity active

security reverse-engineering cli security penetration-testing developer-tools windows cli ctf pwn binary-exploitation glibc one-gadget-rce ruby-gem exploit-development command-line linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="david942j/one_gadget")