rop_scanner — a scanner for ROP/JOP/syscall gadgets in Windows PE files

Tools2026-06-26, 07:29

rop_scanner is a cross‑platform (Windows / Linux / macOS) C++17 tool for locating ROP, JOP, syscall, and stack‑pivot gadgets in Windows PE files (DLL, EXE, SYS, OCX, DRV, EFI). It works without loading modules into memory, decodes bytes using the Zydis disassembler, and outputs discovered gadgets in text, json, ropper format or as a Python dictionary for pwntools.

Use cases: • Searching for useful gadgets in binaries and libraries • Preparing data for building ROP chains • Developing Windows exploits when you need to quickly find gadgets in ntdll.dll, kernelbase.dll, win32u.dll, etc. • Malware analysis • pwn/binary exploitation CTF tasks

Example usage:

shell

rop_scanner ntdll.dll --filter "pop rcx ; pop rdx ; pop r8" --format pwntools```

Compared with tools like `Ropper` and `ROPGadget`, `rop_scanner` is better suited for Windows‑specific features (CFG, PDB, and cross‑module search through Windows system files), although it does not support ELF or Mach‑O binaries.

Tool: https://github.com/oxfemale/rop_scanner

Vendors

Oxfemale

Products

Linux

Macos

Pwntools

Ropgadget

Ropper

Rop_Scanner