4 ms·

I was unfamiliar with the term gadget in this context too, it seems to refer to an exploitation technique to bypass ASLR: https://ctf101.org/binary-exploitatio

I was unfamiliar with the term gadget in this context too, it seems to refer to an exploitation technique to bypass ASLR: https://ctf101.org/binary-exploitation/return-oriented-programming/#:~:text=to%20do%20this%2C%20we'll%20use%20small%20snippets%20of%20assembly%20in%20the%20binary%2C%20called%20%22gadgets.%22%20these%20gadgets%20usually%20pop%20one%20or%20more%20registers%20off%20of%20the%20stack%2C%20and%20then%20call%20ret%2C%20which%20allows%20us%20to%20chain%20them%20together%20by%20making%20a%20large%20fake%20call%20stack https://ctf101.org/binary-exploitation/return-oriented-progr.... https://trustfoundry.net/2019/07/18/basic-rop-techniques-and-tricks-2/ https://trustfoundry.net/2019/07/18/basic-rop-techniques-and...

deleted 4y ago
[deleted]
ethbr0 4y ago
Of the top of my head (not my primary space), a gadget is a piece of code at a known or guessable location that provides specific functionality. This is important as modern no-execute et al. prevent you from simply dumping arbitrary code into memory and running it. Consequently, modern exploits tend to look like: (1) figure out how memory is laid out, or close enough, (2) calculate where a useful function is, that you can call with arbitrary parameters (aka a gadget), (3) abuse that function to do your bidding by controlling its parameters and the instruction pointer. (2) gets around your inability to write + execute code directly, because the system is by definition already set up to allow built-in code to execute. And that built-in code generally does lots of useful things (like reading and writing memory). ASLR makes (1) harder, but fundamental efficiency reasons at the operating system code level mean than usually "everything" isn't fully randomized.
- _kbh_ 4y ago
  > Of the top of my head (not my primary space), a gadget is a piece of code at a known or guessable location that provides specific functionality. > Consequently, modern exploits tend to look like: (1) figure out how memory is laid out, or close enough, (2) calculate where a useful function is, that you can call with arbitrary parameters (aka a gadget), (3) abuse that function to do your bidding by controlling its parameters and the instruction pointer. This is all correct, but generally a gadget is what a snippet of assembly / machine code that you call to get the CPU into a state to call a function. So its less a function and more a set of instructions (anywhere) that are useful. So for example, you might have a gadget to set specific registers with values off the stack so you can call malloc with the correct size, etc.
  - P5fRxh5kUvp2th 4y ago
    Well back in my day ... slips in dentures* a gadget was just a generic thing you played around with and did a thing. Now get the hell off my lawn you whippersnappers, before I throw my teef at you.
  - ethbr0 4y ago
    Thanks for the clarification! I figure if someone is curious enough + looks up links on their own, giving them a good answer is only fair. :)
mikepurvis 4y ago
I don't know if this is intentional, but my brain has always connected the word back to the codename used for the nuclear bomb research being done during WWII: https://en.wikipedia.org/wiki/Gadget_(disambiguation)#Science https://en.wikipedia.org/wiki/Gadget_(disambiguation)#Scienc... The idea being that a code "gadget" is something similarly small and innocuous-looking that turns out to have far, far more powerful effects than anyone would guess just by looking at it.
vario 4y ago

deleted 4y ago

[deleted]

ethbr0 4y ago

Of the top of my head (not my primary space), a gadget is a piece of code at a known or guessable location that provides specific functionality. This is important as modern no-execute et al. prevent you from simply dumping arbitrary code into memory and running it. Consequently, modern exploits tend to look like: (1) figure out how memory is laid out, or close enough, (2) calculate where a useful function is, that you can call with arbitrary parameters (aka a gadget), (3) abuse that function to do your bidding by controlling its parameters and the instruction pointer. (2) gets around your inability to write + execute code directly, because the system is by definition already set up to allow built-in code to execute. And that built-in code generally does lots of useful things (like reading and writing memory). ASLR makes (1) harder, but fundamental efficiency reasons at the operating system code level mean than usually "everything" isn't fully randomized.

_kbh_ 4y ago
> Of the top of my head (not my primary space), a gadget is a piece of code at a known or guessable location that provides specific functionality. > Consequently, modern exploits tend to look like: (1) figure out how memory is laid out, or close enough, (2) calculate where a useful function is, that you can call with arbitrary parameters (aka a gadget), (3) abuse that function to do your bidding by controlling its parameters and the instruction pointer. This is all correct, but generally a gadget is what a snippet of assembly / machine code that you call to get the CPU into a state to call a function. So its less a function and more a set of instructions (anywhere) that are useful. So for example, you might have a gadget to set specific registers with values off the stack so you can call malloc with the correct size, etc.
- P5fRxh5kUvp2th 4y ago
  Well back in my day ... slips in dentures* a gadget was just a generic thing you played around with and did a thing. Now get the hell off my lawn you whippersnappers, before I throw my teef at you.
- ethbr0 4y ago
  Thanks for the clarification! I figure if someone is curious enough + looks up links on their own, giving them a good answer is only fair. :)

mikepurvis 4y ago

I don't know if this is intentional, but my brain has always connected the word back to the codename used for the nuclear bomb research being done during WWII: https://en.wikipedia.org/wiki/Gadget_(disambiguation)#Science https://en.wikipedia.org/wiki/Gadget_(disambiguation)#Scienc... The idea being that a code "gadget" is something similarly small and innocuous-looking that turns out to have far, far more powerful effects than anyone would guess just by looking at it.

vario 4y ago