WCU / Cybersecurity
~/CSC 472/Class 07/KP 06
Class 07 · KP 06 / 18

What Is a Gadget?

attacker stackpadding A*N→ pop rdi ; retgadgetarg1in RDI→ pop rsi ; retgadgetarg2in RSI→ system()target.text / libcexisting code
A ROP chain: each 'ret' launches the next gadget already present in the code.
  • A gadget is a short sequence of instructions that ends in ret (0xc3).
  • Examples: pop rdi ; ret pop rsi ; pop r15 ; ret add rax, rbx ; ret
  • ret pops the next value off the stack into RIP.
  • So a stack full of {gadget addr, data, gadget addr, data, ...} becomes a program whose "instruction pointer" is the stack pointer.
  • Each ret advances us to the next gadget: the stack drives control flow.
Key Takeaway

The stack becomes the instruction stream; ret is the "fetch next gadget" engine.