The ROP chain uses gadgets, which are short code snippets performing a basic function. The instruction what you see in the Python script in the video are the gadgets names, which were selected in the beginning.
As an example, the
XOREAX gadget was a code snippet at address
0x080512c0, which contains the following instructions:
xor eax, eax
So, whet the
XOREAX gadget is called, the
eax register is cleared and a
ret instruction is executed. Because the
ret load an address from the stack and jumps to it, this instruction is used to call the next gadget.
What you see in the Python script is the construction of the payload, which will be placed into the stack. The first address will be the overwritten return address and the next values will be the addresses of the gadgets. In some places in the payload you see
NULL. It is because the previous gadget load some value from the stack into a register, so the value should be placed into the stack also. The
SH is an address points to the
sh string, while the
NULL is an address points to a
0 value in the memory.
So, the whole ROP chain is only initializes the registers to execute a system call.
XOREAX -> clears EAX
POPEBX, SH -> moves 'sh' string to EBX
POPECX, NULL -> moves a pointer to a NULL value to ECX
POPEDX, NULL -> moves a pointer to a NULL value to EDX
ADDEAX3, ADDEAX3, ADDEAX3, ADDEAX2 -> set EAX to 11
SYSCALL -> perform syscall instruction