How are return-oriented programs decompiled/reverse engineered ?
Any pointers to any papers or reports would be appreciated.
This little IDAPython plugin helps in writing and analyzing return oriented payloads. It uses IDA's custom viewers in order to display an array of DWORDs called 'items', where an item can be either a pointer to a gadget or a simple 'value'.
reverse engineering ROP is like normal RE but i recommend to do Dynamic analysis ROP is from my point of view all about ESP , so you faster way to undersand what the ROP code is doing is find Pivot (to get control of ESP) or start of ROP put a breakpoint on it and trace the stack then you can easily understand which functions are getting called and what the ROP code is really doing so key Point to understand the ROP is Stack.