Rop Chains

ROP/JOP chain construction: gadgets, stack pivots, Windows x64 calling, syscall stubs, retpoline/CFG constraints.

netvar1337 2845597 953 B Updated

File contents

ROP / JOP chains

Build order

  1. Leak module base (or find non-ASLR)
  2. Enumerate gadgets (rp++, ROPgadget, Ropper, Zydis-based)
  3. Pivot stack if needed into controllable buffer
  4. Set registers per ABI; call VirtualProtect/mprotect/system
  5. Align stack; handle nopsled of ret for alignment

Windows x64

  • Args: RCX, RDX, R8, R9 + stack
  • 0x20 shadow space before call
  • Gadgets: pop rcx; ret, mov [reg],reg, pushad rare

Linux x64

  • Args: RDI, RSI, RDX, RCX, R8, R9
  • syscall gadget with rax=execve

Mitigations

  • CFG: only valid call targets
  • CET/shadow stack: prefer integrity bypass research or non-return-oriented paths
  • retpoline/IBT: gadget quality drops — verify

Pair with

stack-buffer-overflow, exploit-dev, lang-assembly.

netvar1337/unleash/tree/main/contrib/skills/rop-chains commit 2845597f7b

Frequently asked questions

npx skillmds@latest add netvar1337/rop-chains