The only difference between ROP and return to libc is that instead of 'calling' actual library functions you are 'calling' snipets of code that resemble the end of a function (a few instructions and then a return), which are called gadgets.īy inserting a bunch of gadgets 1 after another on the stack (chaining) you are controlling the execution flow of the application and with enough gadgets you can build a suitibly large application to do whatever you want. What you are doing is creating your own stack (the same as with return to libc). With ROP, understanding this concept is paramount to success. If you find a stack-based buffer overflow and you are able to send enough data to overwrite this address you can change the flow of execution and point eip wherever you want. This happens because when a function is returning it has no way of knowing where in the application code to continue executing.īecause of this the address that execution should return to after the function is finished is pushed onto the stack when the function is called so that it can be retrieved when its finished. This is because the return address that is stored on the stack is pop'ed off of the stack into eip (the instruction pointer).

A stack-based buffer overflow exploit is initiated when the vulnerable function returns. The important part of that in terms of ROP is how the function returns. In my post titled Basic Binary Auditing, in the section called Stack Frames I explain how function calls and returns work. In the last post I didn't really go into much detail about why or how ROP actually works because the post was already pretty long but I thought I'd go into it a bit here.

You can think about obfuscation and such in certain exploitations but when ROP is required obfuscation isn't really an option.

You can read it here.Īs with any exploit development the main point of interest for improvement is reducing the size of the payload so this is where I will focus. If you haven't already read the last post on developing a ROP exploit, you should read that before this because I will not cover anything that I covered there and it is just a continuation of that. So after the last post I kept thinking of ways that I could improve the exploit so I decided to do it.

Test eax eax