https://algoatson.github.io/series/return-oriented-programming/ A remote service with a stack overflow, that forks per connection, and that you have no binary for. Blind ROP turns the only feedback you have — does the connection crash or not — into an oracle, and reads the canary, finds gadgets, and dumps the binary over the socket. The most elegant trick in the ROP toolkit. en Tue, 16 Jun 2026 02:47:52 +0000 https://algoatson.github.io/p/ret2libc-warmup/ https://algoatson.github.io/p/ret2libc-warmup/ Thu, 29 Jan 2026 00:00:00 +0000 pwnctfrop A 200-point warm-up — one unbounded read into a 64-byte stack buffer. No canary, but PIE and ASLR are on, so the leak comes first. Classic ret2libc, written down end to end. https://algoatson.github.io/p/finding-gadgets/ https://algoatson.github.io/p/finding-gadgets/ Tue, 12 May 2026 00:00:00 +0000 pwnroptooling NX means you reuse the code that's already there. Here are the tools that find the pieces, the pwntools layer that assembles them into a chain, and the three structured techniques for when a clean `pop rdi; ret` just isn't in the binary. https://algoatson.github.io/p/ret2csu-universal-gadget/ https://algoatson.github.io/p/ret2csu-universal-gadget/ Thu, 15 Jan 2026 00:00:00 +0000 pwnrop No "pop rsi; pop rdx" in your gadget set? The compiler left one behind for you. __libc_csu_init contains a register-loading sequence and an indirect call that together set rdi, rsi and rdx and call anything — the gadget you reach for when the binary is too small to have its own. https://algoatson.github.io/p/ret2dlresolve-no-leak/ https://algoatson.github.io/p/ret2dlresolve-no-leak/ Sun, 10 May 2026 00:00:00 +0000 pwnropinternals When you can't leak libc, make the dynamic linker resolve system() for you. Forge a relocation, a symbol, and a string, point the lazy-binding machinery at them, and _dl_runtime_resolve looks up the address you couldn't. https://algoatson.github.io/p/stack-pivoting/ https://algoatson.github.io/p/stack-pivoting/ Sat, 30 May 2026 00:00:00 +0000 pwnrop You control the return address but only have room for two or three gadgets after it. Pivot the stack: point rsp at a buffer you fully control and run the real chain from there. leave;ret, pop rsp, xchg — the move that turns a cramped overflow into unlimited ROP. https://algoatson.github.io/p/srop-one-syscall-every-register/ https://algoatson.github.io/p/srop-one-syscall-every-register/ Fri, 22 May 2026 00:00:00 +0000 pwnrop A signal return restores the entire CPU state from a frame on the stack. Forge that frame and a single rt_sigreturn sets rax, rdi, rsi, rdx, rip and rsp at once — the densest gadget in the binary, perfect when you have almost nothing to work with. https://algoatson.github.io/p/one-gadget-constraints/ https://algoatson.github.io/p/one-gadget-constraints/ Thu, 22 Jan 2026 00:00:00 +0000 pwn Somewhere in libc is an address that calls execve("/bin/sh", NULL, NULL) for you — if the registers and stack happen to be in the right shape when you land on it. one_gadget finds them; the constraints decide whether you can use one, and how to bend your context to fit. https://algoatson.github.io/p/setcontext-register-control/ https://algoatson.github.io/p/setcontext-register-control/ Sun, 31 May 2026 00:00:00 +0000 pwnropinternals A single controlled call — from a hook, an FSOP vtable, a function pointer — sets one register and jumps once. setcontext turns that into everything: it restores rsp and the whole register file from a struct you point it at, converting one redirect into a full pivot. The modern bridge from "I control one call" to "I control the machine". https://algoatson.github.io/p/brop-blind-rop/ https://algoatson.github.io/p/brop-blind-rop/ Thu, 14 May 2026 00:00:00 +0000 pwnrop A remote service with a stack overflow, that forks per connection, and that you have no binary for. Blind ROP turns the only feedback you have — does the connection crash or not — into an oracle, and reads the canary, finds gadgets, and dumps the binary over the socket. The most elegant trick in the ROP toolkit.