1

I recently saw a video of someone doing some rop work. And I have a lot of trouble about what is going on. His setup is like this:

[garbage]
[xor eax]
[xor ebx]
[address of "sh"]
[pop ecx]
[address of Null byte]
[pop edx]
[address of Null byte]
[add eax 11]

The first instruction is xor eax (where eip return is) , and I don't understand where the esp is when there are the pop instructions

Link to the video : https://youtu.be/uYHOxlYzH0A

3

The ROP chain uses gadgets, which are short code snippets performing a basic function. The instruction what you see in the Python script in the video are the gadgets names, which were selected in the beginning.
As an example, the XOREAX gadget was a code snippet at address 0x080512c0, which contains the following instructions:

xor eax, eax
ret

So, whet the XOREAX gadget is called, the eax register is cleared and a ret instruction is executed. Because the ret load an address from the stack and jumps to it, this instruction is used to call the next gadget.

What you see in the Python script is the construction of the payload, which will be placed into the stack. The first address will be the overwritten return address and the next values will be the addresses of the gadgets. In some places in the payload you see SH and NULL. It is because the previous gadget load some value from the stack into a register, so the value should be placed into the stack also. The SH is an address points to the sh string, while the NULL is an address points to a 0 value in the memory.

So, the whole ROP chain is only initializes the registers to execute a system call.

XOREAX                             -> clears EAX
POPEBX, SH                         -> moves 'sh' string to EBX
POPECX, NULL                       -> moves a pointer to a NULL value to ECX
POPEDX, NULL                       -> moves a pointer to a NULL value to EDX
ADDEAX3, ADDEAX3, ADDEAX3, ADDEAX2 -> set EAX to 11
SYSCALL                            -> perform syscall instruction
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.