Documentation
README
Performing Return-Oriented Programming
When to Use
- During authorized exploitation when you control the saved return address (via stack overflow, write-what-where, etc.) but NX/DEP prevents executing injected shellcode on the stack.
- When you need to call an existing function (
system,execve,mprotect) or invoke a syscall with attacker-chosen arguments by chaining small...; retgadgets. - When choosing between ret2libc (call a libc function), ret2syscall (raw
sys_execve, common in static binaries), ret2dlresolve, SROP (when gadgets are scarce), or stack pivoting (off-by-one / short overflows). - On ARM64 targets where
retjumps tox30and instructions cannot be entered mid-instruction, requiring JOP or pivot-based approaches.
This is the opening of the README. Read the full README on GitHub.