Skip to content

[Bug] Semantic search crashes with Exception: Invalid syntax: rax when searching for register move operations #200

Description

@HackC0der

Environment

  • Ropper version: Installed via pip in conda environment
  • Python version: 3.12
  • OS: WSL2 (Linux)
  • Target binary: redis-server (x86_64)

Reproduction Steps

  1. Have a valid x86_64 ELF binary (redis-server in this case)
  2. Run semantic search command:
    ropper --file ./redis-server --semantic "mov rbx, rax"
  3. Observe crash during gadget analysis phase

Expected Behavior

Ropper should either:

  1. Return all gadgets that match the semantic "move value from rax to rbx"
  2. Or display a user-friendly error message explaining the correct constraint syntax

Actual Behavior

Ropper crashes with an unhandled exception, no user-friendly error message is provided.

Full Error Log

[INFO] Load gadgets from cache
[LOAD] loading... 100%
[LOAD] removing double gadgets... 100%
[LOAD] analyse gadgets... 100%
[INFO] Searching for gadgets: mov rbx, rax
[ERROR] Please report this error on https://github.com/sashs/ropper
[ERROR] Traceback (most recent call last):
  File "/home/user/miniconda3/envs/pwn_env/lib/python3.12/site-packages/ropper/console.py", line 62, in cmd
    func(self, text)
  File "/home/user/miniconda3/envs/pwn_env/lib/python3.12/site-packages/ropper/console.py", line 1099, in do_semantic
    for fc, gadget in self.__rs.semanticSearch(constraints, stableRegs=stableRegs):
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/miniconda3/envs/pwn_env/lib/python3.12/site-packages/ropper/service.py", line 733, in semanticSearch
    for gadget in s.semanticSearch(fc.gadgets, search, self.options.inst_count, stableRegs):
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/miniconda3/envs/pwn_env/lib/python3.12/site-packages/ropper/search.py", line 139, in semanticSearch
    constraint_values = cc.getSymbols(constraints)
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/user/miniconda3/envs/pwn_env/lib/python3.12/site-packages/ropper/z3helper.py", line 60, in getSymbols
    raise Exception('Invalid syntax: %s' % constraint)
Exception: Invalid syntax: rax

Additional Context

This error occurred during exploit development for CVE-2025-49844, when trying to find suitable ROP gadgets. The semantic search syntax "mov rbx, rax" appears to be valid according to common usage patterns, but the parser fails to handle it correctly.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions