[ROP Notes] #notes #rop #dep #return #exploit #binary

rop_notes.md

Some notes I wrote to myself concerning making of ROP-chains:

• Creating a shellcode / pseudo-shellcode before starting to build the ROP-chain is useful and will be a reference of what you need, especially when trying to do something special in the ROP (eg. not execve ;) )

Quick profit with ROP

This is a quick trick to build a ropchain :)

1. First, you need to find certain gadgets for needed operations:

   a. pop gadget for each of the registers ebx, ecx, edx (for setting them up as arguments for syscall)

   b. xor and inc gadgets for eax (for setting up the syscall number)

   c. syscall (int 0x80) gadget (obvious...)

   d. This is the interesting part: find any couple of registers you can satisfy the following gadget needs with:

    - `mov dword ptr [r1], r2`
    
    - `pop` gadgets for both registers
    
    - `xor` gadget for `r2`
   

2. Now you can start building your ropchain. I will list here the ways to use those gadgets.

3. For arbitrary writes (e.g, writing to .data for storing strings) - you will use the register couple. You will use the following stack layout cycle for every 4 bytes of the string on the stack:

   pop r1
   <write loc>
   pop r2
   <4 bytes from string>
   mov dword ptr [r1], r2

   What happens here is that the write location is poped into r1, the string is poped into r2, and then r2 is moved to the address stored in r1, hence the string is written to the write location. The reason I also specified a xor gadget for r2 is for null-byte at the end of the string, and for zero-ing out location for later manipulation of registers :)

4. For setting up the registers as syscall argument, you place an address pointing to the value you want to write to them, and then pop them. Most common is pointing to a location filled with zeros in .data to zero out the registers. This can obviously be replaced with xor gadget, but those are less common for registers other than eax.

5. eax's gadgets and the syscall gadget are obviously used for the syscall :)