Exploiting Buffer Overflows on RISC-V
summary
Hands-on demonstration of overflowing a RISC‑V stack buffer to overwrite return addresses, build inline assembler shellcode, and perform ret2libc/ROP chains that successfully spawn a shell. Uses QEMU emulation and standard tooling: objdump to find symbols, gdb to trace crashes, a small Python script to generate exploit payloads and a fixed-env helper to stabilize stack layout. Notes that RISC‑V is little‑endian with 32 registers, gadgets count in the 1000+ range, demos require ASLR disabled and work under emulation though hardware is becoming available.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 0:33Agenda
- 5:24RISCV Architecture
- 9:47Important registers
- 12:40How a buffer works
- 13:04Local variables
- 13:40Hacking
- 13:57Buffer Overflow
- 15:04Approach
- 16:36Shell Code
- 17:41Buffer Size
- 20:43Snail bites
- 21:17Using odd numbers
- 21:48Using larger numbers
- 22:14Writable stack
- 22:41Shellcode
- 22:55Overwrite Buffer
- 23:26Program nominee
- 24:52Object dump
- 25:50Fill the buffer
- 26:57Fix the stack
- 28:10Questions
- 31:19Userspace
- 35:59Summary
related talks
36mExploiting Buffer Overflows on RISC-V
47mA Security RISC? The State of Microarchitectural Attacks on RISC-V
57mReturn Oriented Programming, an introduction
22mDemostrating Binary Exploitation
51mThe Anatomy of an Exploit
34mRISC-V-Based Sandboxing for Secure and Efficient Software Execution
57mReturn Oriented Programming, an introduction
57mThe Anatomy of an Exploit