Return Oriented Programming, an introduction
summary
Explains how to get code execution on non-executable stacks by converting C shellcode into inline assembly then into a ROP chain, using 32-bit addresses to avoid null bytes, finding gadgets with ropper, assembling gadgets like pop eax; mov [edx], eax; xor eax; and ending with int 0x80 to call /bin/sh. Builds the exploit string, feeds it to the vulnerable program under GDB, and demonstrates that the chain succeeds — a working shell is obtained.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 1:10Talk overview
- 2:35Weird machine basics
- 5:30Shellcode intro 32-bit
- 7:17Shellcode goals syscalls
- 9:04C to shellcode method
- 11:18Inline assembly syscalls
- 13:28Close syscall assembly
- 16:20Open syscall string
- 20:34Execve syscall assembly
- 22:17Testing shellcode
- 23:01Introduction to return oriented programming
- 25:30ROP chains gadgets
- 27:59ROP chain exploit
- 30:05Ropper automation
- 32:14Analyzing Ropper chain
- 35:05ROP gadget breakdown
- 41:11Custom ROP chain
- 44:02Missing gadgets search
- 45:26Final exploit string
- 46:33Exploit testing GDB
- 48:44Shellcode demo
- 49:25Training closing
- 50:09ROP Windows platforms
- 52:35Mitigations challenges
related talks
57mReturn Oriented Programming, an introduction
57mThe Anatomy of an Exploit
51mThe Anatomy of an Exploit
49mPossibility of Arbitrary Code Execution via Step‑Oriented Programming
36mExploiting Buffer Overflows on RISC-V
33mHacking in Darkness: Return-oriented Programming against Secure Enclaves
36mExploiting Buffer Overflows on RISC-V
35mCommSec D2 - Automatic Generation of ROP Chains