Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I noticed that exploits which use Return Oriented Programming always find the gadgets in libraries. I wonder if it is possible to use gadgets from the executable (.exe) itself?

share|improve this question
1  
I think that is the point. The Executable and statically linked libraries are the source of ROP's, Dynamically linked libraries will be ASLR'ed –  Rook May 7 '13 at 18:34

2 Answers 2

up vote 1 down vote accepted

I believe the reason is "it's easiest to use instruction sequences from the libraries, because the libraries are so common and they've already been scanned."

There are just a handful of Microsoft-provided C-runtime library files. If they provide a complete enough instruction set, why work harder?

share|improve this answer

Yes, absolutely, of course it is possible to use gadgets that are from the executable itself. You can use any code that is mapped into the address space of the program in executable form (i.e., where it's possible to execute the code -- if the system is using DEP, this excludes anything that has the non-executable bit set). That includes the original executables, any libraries that are loaded into memory, and anything else in memory that has its permissions set to executable.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.