ROP / JOP chains
Build order
- Leak module base (or find non-ASLR)
- Enumerate gadgets (
rp++, ROPgadget, Ropper, Zydis-based) - Pivot stack if needed into controllable buffer
- Set registers per ABI; call VirtualProtect/mprotect/system
- Align stack; handle nopsled of
retfor alignment
Windows x64
- Args: RCX, RDX, R8, R9 + stack
- 0x20 shadow space before call
- Gadgets:
pop rcx; ret,mov [reg],reg,pushadrare
Linux x64
- Args: RDI, RSI, RDX, RCX, R8, R9
syscallgadget with rax=execve
Mitigations
- CFG: only valid call targets
- CET/shadow stack: prefer integrity bypass research or non-return-oriented paths
- retpoline/IBT: gadget quality drops — verify
Pair with
stack-buffer-overflow, exploit-dev, lang-assembly.