Class 07 · KP 12 / 18

one_gadget: One Address, Instant Shell

A ROP chain: each 'ret' launches the next gadget already present in the code.

libc contains "magic" spots that call execve("/bin/sh", ...) if certain constraints hold at that moment.
one_gadget finds them and lists their preconditions.

$ one_gadget libc.so.6
0x4f2a5 execve("/bin/sh", rsp+0x40, environ)
constraints:
  rsp & 0xf == 0 && rcx == NULL
0x4f302 execve("/bin/sh", rsp+0x40, environ)
constraints:
  [rsp+0x40] == NULL

Payload becomes trivial: libc_base + one_gadget_offset in the return slot — if its constraints are satisfied.
Great when gadgets are scarce; you may need to try several offsets.