xgadget

Leverages multiple cores to search single or multiple binaries simultaneously, processing 10 Linux kernels in under 10 seconds in benchmarks, as shown in the README.

Filters gadgets by register usage behavior (overwrite, read, memory access) without SMT solving, enabling precise control for exploit development, as detailed in CLI options like --reg-overwrite.

Finds gadgets that work across multiple binary variants (e.g., different compiler versions) with full and partial matches, supporting anti-diversification research, illustrated with diagrams in the README.

Uses instruction semantics for JOP gadget discovery instead of hardcoded regex patterns, improving accuracy and efficiency, with options like --dispatcher for filtering.