CommSec D2 - Automatic Generation of ROP Chains
summary
A Python 3 tool named EasyROP searches a binary with Capstone for gadgets implementing random‑access‑machine ops (load constant, move, load/store, ALU, branch) from XML specs and emits ROP chains; released under GPLv3. Evaluation finds shell32.dll on 32‑bit Windows supplies all required gadgets (64‑bit DLLs do not reach Turing completeness because conditional branches are missing). A generated chain for CVE-2010-3333 disables DEP and launches calc; generation takes about one minute.
AI-written summary · about
chapters (10)
- 0:00Introduction and motivation
- 3:47Write XOR Execute defense
- 7:27ROP attacks explained
- 12:06Adversary power concept
- 15:03ROP tool development
- 20:06Evaluation on Windows
- 23:23Case study vulnerability
- 27:00Demo and exploit
- 31:52Conclusions and future work
- 32:35Q&A session
related talks
37mPre-built JOP Chains with the JOP ROCKET: Bypassing DEP without ROP
57mReturn Oriented Programming, an introduction
57mReturn Oriented Programming, an introduction
35mOn Securing Legacy Software Against Code-Reuse Attacks
55mThe Beast is in Your Memory
33mHacking in Darkness: Return-oriented Programming against Secure Enclaves
27mWhat Cannot Be Read, Cannot Be Leveraged? Revisiting Assumptions of JIT-ROP...
21mDemystify Today's Binary Disassembling and How Modern ABI Makes it Easier