- Creating a shellcode / pseudo-shellcode before starting to build the ROP-chain is useful and will be a reference of what you need, especially when trying to do something special in the ROP (eg. not execve ;) )
This is a quick trick to build a ropchain :)
-
First, you need to find certain gadgets for needed operations:
a.
popgadget for each of the registersebx,ecx,edx(for setting them up as arguments for syscall)
b. xor and inc gadgets for eax (for setting up the syscall number)