Class 07 · KP 09 / 18

Finding Gadgets: ROPgadget and ropper

A ROP chain: each 'ret' launches the next gadget already present in the code.

Search the binary (and libc) for sequences ending in ret:

# ROPgadget
ROPgadget --binary ./vuln | grep ": pop rdi ; ret"
# -> 0x000000000040123b : pop rdi ; ret

# ropper (alternative, similar output)
ropper --file ./vuln --search "pop rdi"

# find the "/bin/sh" string inside libc
strings -a -t x libc.so.6 | grep /bin/sh

Addresses in a PIE/libc are offsets until you know the load base (that base comes from a leak — Class 08 / ASLR).
Non-PIE binaries give you fixed addresses for the program's own gadgets.