Return Oriented Programming, an introduction
summary
Shows a working 32‑bit x86 exploit that builds shellcode for execve /bin/sh by implementing close, open and execve via syscall numbers in eax and int 0x80, then replaces executable stack code with a chained sequence of existing instructions found in the binary. Uses ropper to auto-find gadgets (about nine key gadgets plus several pops), crafts a Python payload that handles bad bytes and string writes, tests in GDB against the target binary and successfully spawns a shell.
AI-written summary · about
chapters (12)
- 0:00Introduction to exploitation
- 1:03Target application overview
- 3:08Understanding shellcode
- 5:28Syscalls and registers
- 9:03Writing and testing C code
- 12:20Developing assembly shellcode
- 23:36Return oriented programming
- 30:56Using ropper for chains
- 34:03Analyzing gadget execution
- 36:49Building the ROP chain
- 43:35Execution and results
- 50:42Q&A and protections
related talks
57mReturn Oriented Programming, an introduction
57mThe Anatomy of an Exploit
51mThe Anatomy of an Exploit
36mExploiting Buffer Overflows on RISC-V
36mExploiting Buffer Overflows on RISC-V
49mPossibility of Arbitrary Code Execution via Step‑Oriented Programming
33mHacking in Darkness: Return-oriented Programming against Secure Enclaves
57mMake ARM Shellcode Great Again