~/CSC 472/Class 07

CSC 472 · Class 07

Return-Oriented Programming and ret2libc

18 knowledge points. Work through them in order, or jump to any topic.

//

Knowledge Points

01Recap: We Could Just Inject Shellcode... Until Now → 02Code Reuse: The Big Idea → 03ret2libc: Call system("/bin/sh") Without Shellcode → 0432-bit ret2libc: Arguments Live on the Stack (cdecl) → 0564-bit ret2libc: Arguments Go in Registers (System V) → 06What Is a Gadget? → 07A ROP Chain on the Stack → 08Why "pop rdi ; ret" Is the Star Gadget → 09Finding Gadgets: ROPgadget and ropper → 10pwntools Does the Bookkeeping: ROP() → 11The x86-64 movaps Alignment Trap → 12one_gadget: One Address, Instant Shell → 13When Gadgets Are Scarce: ret2csu → 14ROP Is Turing-Complete; Its Cousins JOP and COP → 15Defenses Against Code Reuse → 16Attacker vs Defender: The Arms Race → 17Tie-In to Lab 4 → 18Summary →