Exploit Development

Return-Oriented Programming, or ROP, is a technique that chains together tiny fragments of existing code called gadgets, each ending in a ret instruction. By placing a sequence of gadget addresses on the stack, each ret transfers control to the next, so the CPU runs logic assembled from borrowed pieces without any new code being injected.

Because NX, also called DEP, marks data regions like the stack and heap as non-executable, so injected machine code simply will not run. ROP is the response: rather than bringing your own code, you reuse code that is already present and already marked executable, chaining small gadgets to achieve the same result.

A gadget is a short sequence of instructions, found in the program or a linked library, that ends in a ret. The most useful are pop gadgets like pop rdi ; ret, which load a value from the stack into a register. Chaining gadget addresses on the stack runs them one after another to set up a function call.

ASLR and PIE randomise where code and the stack load each run, so you cannot hard-code a gadget or function address. An information leak, from a separate bug or a feature that prints a pointer, reveals one real runtime address. Because relative offsets are fixed, you compute all the other addresses from that single leaked value.

ret2libc is an early, simple form of code reuse where you return directly into a library function, such as one that executes a command. ROP generalises that idea into arbitrary chains of small gadgets, letting you build far more flexible behaviour. ret2libc is best seen as the historical root of the broader ROP technique.

Because x86-64 requires the stack pointer to be 16-byte aligned at the moment of a call, and SSE instructions like movaps inside standard library functions fault when it is not. A chain that looks correct can crash this way. The usual fix is to insert one extra bare ret gadget before the call, which shifts rsp by eight bytes and restores alignment.