Understand NX Bit and Return-Oriented Programming

Topic Overview

NX Bit and Return-Oriented Programming

The NX (No-eXecute) bit marks memory regions like the stack and heap as non-executable. This prevents attackers from injecting and executing shellcode directly on the stack, which was the classic exploitation technique before NX became standard.

How NX Changes Exploitation

Memory pages have permission bits: read (R), write (W), execute (X). Stack and heap are typically RW- (no execute). Attempting to jump to shellcode on the stack triggers SIGSEGV.

Return-Oriented Programming (ROP) bypasses NX by reusing existing executable code:

• Find short instruction sequences ending in ret (gadgets)
• Chain gadget addresses on the stack
• Each ret pops the next gadget address

Common x86-64 gadgets:

• pop rdi; ret: set first function argument
• pop rsi; ret: set second argument
• syscall; ret: invoke a system call

For This Exercise

You will classify a target address against a real /proc/self/maps-style memory map: parse regions with their permission strings, find which region contains the target, and decide whether the target is executable, NX-protected, or unmapped. This is the lookup an exploit writer performs before every jump, and why a stack address fails under NX while code-segment addresses still work.

From Gadgets to Execution

NX does not execute new instructions; it only prevents the stack and heap from being executable. ROP reuses instructions already in executable regions. A chain calling mprotect can mark a stack page executable, reviving classic shellcode techniques. More commonly, chains call system or execve directly. Intel CET shadow stacks and ARM Pointer Authentication record return addresses to detect ROP, but the technique remains central to exploit development education.

Write a C program that reads a memory map in /proc/self/maps format and a target address from stdin, then classifies the target address.

Requirements:

• Read the region count, then each region as START-END PERMS (e.g. 00400000-00401000 r-xp), then the target address in hex
• Find the region that contains the target: base <= addr < end (the end is exclusive, exactly as the kernel reports it)
• Print the containing region with its permission string
• Classify: EXECUTABLE if the permission string contains 'x', NOT EXECUTABLE (NX) otherwise, and unmapped targets would fault with SIGSEGV

Success Criteria:

• Region containment uses the half-open interval [start, end), matching the kernel's convention
• The permission check is done against the parsed permission string, not hardcoded addresses
• An address exactly at a region's end must be reported as unmapped