Code Reuse: The Big Idea

• The binary and shared libraries (libc, ld) are mapped r-x: readable and executable.
• We still control the return address via a stack overflow.
• Instead of pointing ret at our data, we point it at code that already exists.
• Two flavors, increasing in power:
• ret2libc: return straight into a useful libc function (e.g. system).
• ROP: chain many tiny snippets ("gadgets") to compute almost anything.