skip to content

algoatson.github.io ~/series/return-oriented-programming

❯ segfault@algoatson.github.io

return-oriented programming

9 parts~32 min rss

❯ start at part 1 ›

#1pwn ret2libc on a warm-up: stack smash to shell4 min

#2pwn finding gadgets: ROPgadget, ropper, one_gadget, pwntools5 min

#3pwn ret2csu — the universal gadget hiding in every binary3 min

#4pwn ret2dlresolve — a shell with no libc leak3 min

#5pwn stack pivoting — when the overflow is too small3 min

#6pwn SROP — one syscall, every register3 min

#7pwn one_gadget — a shell in a single address3 min

#8pwn the setcontext gadget — one call to every register4 min

#9pwn BROP — return-oriented programming without the binary4 min