# Rop Chains

> ROP/JOP chain construction: gadgets, stack pivots, Windows x64 calling, syscall stubs, retpoline/CFG constraints.

- Skill: `netvar1337/rop-chains` (Agent Skill)
- Install (CLI): `npx skillmds@latest add netvar1337/rop-chains`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/rop-chains/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/rop-chains

---


# ROP / JOP chains

## Build order
1. Leak module base (or find non-ASLR)
2. Enumerate gadgets (`rp++`, ROPgadget, Ropper, Zydis-based)
3. Pivot stack if needed into controllable buffer
4. Set registers per ABI; call VirtualProtect/mprotect/system
5. Align stack; handle nopsled of `ret` for alignment

## Windows x64
- Args: RCX, RDX, R8, R9 + stack
- 0x20 shadow space before call
- Gadgets: `pop rcx; ret`, `mov [reg],reg`, `pushad` rare

## Linux x64
- Args: RDI, RSI, RDX, RCX, R8, R9
- `syscall` gadget with rax=execve

## Mitigations
- CFG: only valid call targets
- CET/shadow stack: prefer integrity bypass research or non-return-oriented paths
- retpoline/IBT: gadget quality drops — verify

## Pair with
`stack-buffer-overflow`, `exploit-dev`, `lang-assembly`.