\subsection*{RopMate}
Another field in which security visualization can provide its support is undoubtedly red teaming. In this specific case, a solution called ROPMate \cite{ROPMate_paper} is presented, targeting ROP exploit builders. Return-oriented programming (ROP) is one of the main ``code reuse" techniques used in cases where security measures are implemented to defend against code injection attacks. In the specific case of ROP the attacker leverages existing code sequences called ``gadgets" to manipulate the program's control flow. By chaining these gadgets together, the attacker can bypass security measures and execute malicious actions. The purpose of the research and the developed prototype \cite{ropmate_github} aims to introduce a support that allows assistance in constructing the rope chain, or in other words the ROP gadgets sequence, which is still predominantly performed manually. Through the GitHub page of the prototype, it is possible to download and subsequently run the server on which the application is rendered. In addition to the prototype code, the developers have provided test files that can be used to perform operations and test the tool. Further details regarding the type of input files and their production will be discussed later, following the presentation of the various visualizations.

After downloading the application code and installing the necessary requirements for its functionalities, it is possible to launch the server and access the tool through a browser. Once again, the tool consists of a single-page application (figure \ref{fig:RopMate}) that displays various types of visualizations, divided based on their usage, within its interface. In the upper section, we immediately notice the various options for applying filters, modifying the memory threshold, and the button that allows uploading a new file for analysis. On the left-hand side, it is possible to select different registers to further filter the various gadgets. Moving to the main part of the visualization, we find the Tree View, which represents the list of various analyzed gadgets. They are organized hierarchically based on the type of operations and classes. Each gadget is accompanied by a corresponding bar located on its right side, representing the memory space it requires. The bar is colored red if it exceeds the set threshold, and green if it does not. In addition to the information about the required memory, on the corresponding line of each gadget, we can find the dereferenced registers matrix. This matrix indicates which registers are dereferenced from the corresponding gadget. Each register is represented by a column. If the dependency is not satisfied, the column is filled to its full height. If the dependency is satisfied, the column is filled halfway. In the rightmost section (figure \ref{fig:RopMate_right}), there is a box that provides various information about the gadget. It includes the gadget's assembly code, memory address, registers it modifies, and registers it dereferences. By clicking on a gadget in the box, it is added to the rop chain. Just below, we find the similarity pane which, when a gadget is selected, displays all the gadgets that perform the same operation. Finally, below the Tree View visualization, we have the displayed rop chain (figure \ref{fig:RopMate_chain}), where gadgets are represented by movable rectangles to modify the chain. Additional information is shown both inside and below each gadget rectangle. An example of Python code, generated from the chain shown in the figure, calculated using the ``dump" button located above the chain, is provided below \ref{ROPChain_code}. 

\begin{figure}[h]
    \centering
    \includegraphics[scale=.26]{Figures/chapter4/RopMate/RopMate.png}
    \caption{ROPMate dashboard}
    \label{fig:RopMate}
\end{figure}
\begin{figure}[h]
    \centering
    \includegraphics[scale=.26]{Figures/chapter4/RopMate/RopMate_chain.png}
    \caption{ROPMate chain builder}
    \label{fig:RopMate_chain}
\end{figure}

In the discussion of the various development phases, limited information is provided about each individual phase. Therefore, we will now summarize only two phases that refer to the model mentioned in previous chapters. Regarding the \emph{Data Preparation} phase, it can be stated that the data provided to the application consists of gadgets obtained through a tool developed by the same developers of the tool we are analyzing. This tool takes a binary file as input and produces its corresponding gadgets, which are listed in a JSON format. The data are therefore processed by the ROP-gadget semantics analyzer and subsequently fed into ROPMate to obtain the visualizations mentioned earlier. Regarding the \emph{Feedback and fine-tune} phase, expert user evaluations were conducted, and the paper provides a visualization of the tool before this phase to demonstrate the developments and improvements that have been made based on the feedback of ethical hackers. The general feedback was positive, with testers considering the tool ``very useful and user-friendly". However, the development appears to be stagnant at the moment, given the dates of the latest updates available on the GitHub repository.

\begin{lstlisting}[language=python, label=ROPChain_code, caption={Python code of the ROP chain}, firstnumber=1]
IMAGE_BASE = 0x0
rebase = lambda x : p64(x + IMAGE_BASE)

rop = ''
rop += rebase(0x4016ea) #pop rax; ret
rop += p64(0x0)
rop += rebase(0x4942df) #mov rbp, qword ptr [rax + 8]; add rbx, rbp; mov qword ptr [rsp + 0x10], rbx; ret
rop += rebase(0x44b4c8) #mov qword ptr [rbx + 0x88], rdx; add rsp, 0x50; ret
rop += p64(0x0)
rop += p64(0x0)
rop += p64(0x0)
rop += p64(0x0)
rop += p64(0x0)
rop += p64(0x0)
rop += p64(0x0)
rop += p64(0x0)
rop += p64(0x0)
rop += p64(0x0)
\end{lstlisting}

\begin{figure}[!h]
    \centering
    \includegraphics[scale=.25]{Figures/chapter4/RopMate/RopMate_right.png}
    \caption{ROPMate Analysis pane and Similarity Pane}
    \label{fig:RopMate_right}
\end{figure}

Its major strength lies in being one of the few, if not the only, alternatives to the traditional tools for constructing rop chains, particularly by utilizing visualization as support for gadget selection. Another strong point is the usability of the tool, which gives the impression of a complete application rather than a prototype. On the other hand, the greatest limitation is the requirement to use the ROPDaemon \cite{ropdaemon_github} tool, also developed by the same developers. This limitation not only restricts its compatibility with other existing tools but also compromises usability, as the version available on the ROPDaemon repository is currently unusable due to issues with the provided code. Therefore, no example test is provided in this section, as it would be similar to the one presented in the original ROPMate paper. For a comprehensive example, I would recommend referring to the original paper for a complete demonstration \cite{ROPMate_paper}.





