3 ms·

Short answer: No Long answer: It depends on what you define as arbitrary code execution. In a good number of cases, you can use ROP to execute whatever "code"

by daeken 16y ago

Short answer: No Long answer: It depends on what you define as arbitrary code execution. In a good number of cases, you can use ROP to execute whatever "code" (made up of little bits of existing program code repurposed for your needs) you wish, and accomplish whatever you want to accomplish. In many cases, this is finding your "real" code and setting memory protection such that you can jump into it. In effect, if you have control over EIP, you've already owned the system; it might not be easy to do everything you want to do, but it's effectively always possible.

ximeng 16y ago
Interesting, thanks. According to Google, ROP is return-oriented programming, where you build up a program by jumping to near the end of existing executable subroutines. The control flow comes from corrupting the stack with a list of the addresses of this code. The example here: http://cseweb.ucsd.edu/~hovav/dist/sparc.pdf http://cseweb.ucsd.edu/~hovav/dist/sparc.pdf uses a stack overflow. I'm not sure how this would work with just an arbitrary EIP though. Seems to me you need a bit more than that.