Questions about this topic? Sign up to ask in the talk tab.

Return Oriented Programming (ROP)

From NetSec
Revision as of 10:23, 26 November 2012 by LashawnSeccombe (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Return Oriented Programming (also known as ROP) is used in buffer overflow payloads to defeat DEP. It is very similar to writing a call stack by hand.

This article contains too little information, it should be expanded or updated.
Things you can do to help:
  • add more content.
  • update current content.
  • Theory

In linked binary executables, assembly syntax for calling a function is:

 
push $arg2
push $arg1
call function
 

Because the ret instruction is similar to pop %eip, it is also possible to call a function this way:

 
push $arg2
push $arg1
push pointer_to_function
ret
 

When calling multiple functions:

 
push $func2arg2
push $func2arg1
push pointer_to_func2
push $func1arg2
push $func1arg1
push pointer_to_func1
ret
 

When a buffer overflow takes place, %eip or %rip is set to the last dword or qword pushed to the stack, respectively. This behavior originates from the return instruction (ret) and therefore one can craft their buffer overflow shellcode in a similar format to:

 [nops][func2arg2][func2arg1][pointer_to_func2][func1arg2][func1arg1][pointer_to_func1]