Return Oriented Programming
Some notes. Tools for finding gadgets rp++ ROPgadget Ret2libc When the program has NX enabled, shellcode on the stack can’t execute; you can use ret2libc, or use ROP to call mprotect and open an rwx segment. Passing arguments x86 via the stack x86_64 via registers Ret2libc stack layout Stack the arguments as completely as possible to avoid annoying issues. The usual x86 layout is: padding + function + ret address + argv1 + argv2 + argv3 .... The function can usually jump straight to .plt; the ret address is where you want to go after it finishes. If you’re just building system("/bin/sh"), the ret address can be left blank. ...