3 ms·
> We need to first let PC jumps to an intermediate gadget, IMO ROP gadgets are terribly clever. Since you can't just execute new malicious code but you do hav
by wyldfire 7y ago
> We need to first let PC jumps to an intermediate gadget,
IMO ROP gadgets are terribly clever. Since you can't just execute new malicious code but you do have control over which instruction to execute next, you have to scour the executable and its libraries for any content that would have the effects that you require.
Take a look at the output from ROPGadget [1] (look at "ROP Chain Generation" screenshot) to see an example of how it works.
[1] https://github.com/JonathanSalwan/ROPgadget https://github.com/JonathanSalwan/ROPgadget
- kardos 7y agoROP gadgets are indeed clever. Meanwhile there are efforts afoot [1,2] to mitigate this line of attack by removing all of the ROP gadgets, which is also rather clever. [1] https://www.openbsd.org/papers/asiabsdcon2019-rop-paper.pdf https://www.openbsd.org/papers/asiabsdcon2019-rop-paper.pdf [2] https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf