Summary

• NX kills injected code; reuse existing executable code.
• ret2libc: 32-bit args on stack, 64-bit args in registers (need pop rdi ; ret).
• ROP: chain gadgets via the stack; Turing-complete.
• Watch the movaps 16-byte alignment; one_gadget and ret2csu are handy shortcuts.
• Defenses: ASLR (needs a leak), CFI, Intel CET (shadow stack + IBT).