Build a Return-Oriented Programming Chain

Topic Overview

Building a ROP Chain

A ROP chain is a carefully constructed sequence of gadget addresses placed on the stack. Each gadget performs a small operation and ends with ret, which loads the next gadget address. By chaining enough gadgets, attackers perform arbitrary computations without injecting new code.

Constructing a Chain

Find gadgets with tools like ROPgadget, ropper, or objdump. For calling system("/bin/sh") on x86-64 Linux:

cCopy
Loading…

Challenges include NULL bytes in addresses (terminate strcpy), 16-byte stack alignment before system(), and ASLR randomizing all addresses.

For This Exercise

You will write the chain simulator itself: given the four gadget addresses and the stack quadwords laid out by the overflow, walk the chain exactly as the CPU would: each ret pops the next value, pop rdi; ret and pop rsi; ret consume an argument slot, and reaching system() consumes its slot. You will then verify the System V stack alignment at system()'s entry, the exact mistake that causes the infamous movaps crash.

Gadget Hunting in Practice

ROPgadget scans executable segments for sequences ending in ret. Libc is gadget-rich because it contains millions of instructions compiled from C source. Useful gadgets need not be full functions; pop rdi; ret is just two instructions. Defenders deploy Control Flow Integrity and shadow stacks, but understanding basic chain construction remains essential for CTF competitions and vulnerability research on unpatched services.

Write a C program that simulates executing a ROP chain.

Requirements:

• Read the four gadget addresses (pop rdi; ret, pop rsi; ret, bare ret, system), the stack address of the first chain slot, and the chain quadwords (in pop order) from stdin
• Start with RIP = first quadword; pop rdi/rsi gadgets consume the next slot as the register value then continue to the next slot; a bare ret consumes no argument slot
• Reaching system() computes the RSP at entry (base - 8 * slots consumed) and checks the System V ABI alignment: RSP % 16 must be 8, otherwise the chain faults on movaps inside system
• Any address matching none of the gadgets breaks the chain; a missing argument slot means the stack is exhausted

Success Criteria:

• The register-pop semantics consume exactly one extra slot per pop gadget
• The alignment check reproduces both outcomes: OK (RSP%16=8) and MOVAPS FAULT (RSP%16=0), with the bare-ret fix demonstrated by the test inputs
• Unrecognized gadget addresses are reported as chain breakage, not silently skipped