Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
4 clarity
source | link

Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the stack: https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#chainingbasics http://neilscomputerblog.blogspot.com/2012/06/stack-pivoting.html

Also, for XXX/actual constants (immediates) for SUB/ADD ESP XXX, you can always LEA a register then even MOV ESP, XXX/REG:

https://web.archive.org/web/20171107030509/http://x86.renejeschke.de/html/file_module_x86_id_176.html

Last, depending on the DLL/EXE you're searching for gadgets in, if you can't easily ADD/SUB ESP you could do a slew of things (using volatile registers):

;ADD/INC ESP SEMANTICS EQUIVALENT 
POP EBX      ;semantically same as MOV EBX, ESP; ADD ESP 0x4
XOR EBX, EBX ;zeroes EBX if you wanna reuse the register

;SUB/DEC ESP SEMANTICS EQUIVALENT
PUSH EBX     ;semantically same as MOV ESP, EBX; SUB ESP 0x4

You can even get fancy and mov values into a volatile register, SHL/SHR/ROL/ROR it and then use LEA/PUSH. It's all up to you to be creative!

Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the stack: https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#chainingbasics http://neilscomputerblog.blogspot.com/2012/06/stack-pivoting.html

Also, for XXX/actual constants (immediates) for SUB/ADD ESP XXX, you can always LEA a register then even MOV ESP, XXX/REG:

https://web.archive.org/web/20171107030509/http://x86.renejeschke.de/html/file_module_x86_id_176.html

Last, depending on the DLL/EXE you're searching for gadgets in, if you can't easily ADD/SUB ESP you could do a slew of things (using volatile registers):

;ADD SEMANTICS EQUIVALENT 
POP EBX      ;semantically same as MOV EBX, ESP; ADD ESP 0x4
XOR EBX, EBX ;zeroes EBX if you wanna reuse the register

;SUB SEMANTICS EQUIVALENT
PUSH EBX     ;semantically same as MOV ESP, EBX; SUB ESP 0x4

You can even get fancy and mov values into a volatile register, SHL/SHR/ROL/ROR it and then use LEA/PUSH. It's all up to you to be creative!

Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the stack: https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#chainingbasics http://neilscomputerblog.blogspot.com/2012/06/stack-pivoting.html

Also, for XXX/actual constants (immediates) for SUB/ADD ESP XXX, you can always LEA a register then even MOV ESP, XXX/REG:

https://web.archive.org/web/20171107030509/http://x86.renejeschke.de/html/file_module_x86_id_176.html

Last, depending on the DLL/EXE you're searching for gadgets in, if you can't easily ADD/SUB ESP you could do a slew of things (using volatile registers):

;ADD/INC ESP SEMANTICS EQUIVALENT 
POP EBX      ;semantically same as MOV EBX, ESP; ADD ESP 0x4
XOR EBX, EBX ;zeroes EBX if you wanna reuse the register

;SUB/DEC ESP SEMANTICS EQUIVALENT
PUSH EBX     ;semantically same as MOV ESP, EBX; SUB ESP 0x4

You can even get fancy and mov values into a volatile register, SHL/SHR/ROL/ROR it and then use LEA/PUSH. It's all up to you to be creative!

3 added archived link, as the original for MOV semantics was removed
source | link

Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the stack: https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#chainingbasics http://neilscomputerblog.blogspot.com/2012/06/stack-pivoting.html

Also, for XXX/actual constants (immediates) for SUB/ADD ESP XXX, you can always LEA a register then even MOV ESP, XXX/REG:

http://x86.renejeschke.de/html/file_module_x86_id_176.htmlhttps://web.archive.org/web/20171107030509/http://x86.renejeschke.de/html/file_module_x86_id_176.html

Last, depending on the DLL/EXE you're searching for gadgets in, if you can't easily ADD/SUB ESP you could do a slew of things (using volatile registers):

;ADD SEMANTICS EQUIVALENT 
POP ECXEBX      ;semantically same as MOV ECXEBX, ESP; ADD ESP 0x4
XOR ECXEBX, ECXEBX ;zeroes ECXEBX if you wanna reuse the register

;SUB SEMANTICS EQUIVALENT
PUSH ECXEBX     ;semantically same as MOV ESP, ECX;EBX; SUB ESP 0x4

You can even get fancy and mov values into a volatile register, SHL/SHR/ROL/ROR it and then use LEA/PUSH. It's all up to you to be creative!

Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the stack: https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#chainingbasics http://neilscomputerblog.blogspot.com/2012/06/stack-pivoting.html

Also, for XXX/actual constants (immediates) for SUB/ADD ESP XXX, you can always LEA a register then even MOV ESP, XXX/REG:

http://x86.renejeschke.de/html/file_module_x86_id_176.html

Last, depending on the DLL/EXE you're searching for gadgets in, if you can't easily ADD/SUB ESP you could do a slew of things (using volatile registers):

;ADD SEMANTICS EQUIVALENT 
POP ECX      ;semantically same as MOV ECX, ESP; ADD ESP 0x4
XOR ECX, ECX ;zeroes ECX if you wanna reuse the register

;SUB SEMANTICS EQUIVALENT
PUSH ECX     ;semantically same as MOV ESP, ECX; SUB ESP 0x4

You can even get fancy and mov values into a volatile register, SHL/SHR/ROL/ROR it and then use LEA/PUSH. It's all up to you to be creative!

Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the stack: https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#chainingbasics http://neilscomputerblog.blogspot.com/2012/06/stack-pivoting.html

Also, for XXX/actual constants (immediates) for SUB/ADD ESP XXX, you can always LEA a register then even MOV ESP, XXX/REG:

https://web.archive.org/web/20171107030509/http://x86.renejeschke.de/html/file_module_x86_id_176.html

Last, depending on the DLL/EXE you're searching for gadgets in, if you can't easily ADD/SUB ESP you could do a slew of things (using volatile registers):

;ADD SEMANTICS EQUIVALENT 
POP EBX      ;semantically same as MOV EBX, ESP; ADD ESP 0x4
XOR EBX, EBX ;zeroes EBX if you wanna reuse the register

;SUB SEMANTICS EQUIVALENT
PUSH EBX     ;semantically same as MOV ESP, EBX; SUB ESP 0x4

You can even get fancy and mov values into a volatile register, SHL/SHR/ROL/ROR it and then use LEA/PUSH. It's all up to you to be creative!

2 edited body
source | link

Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the stack: https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#chainingbasics http://neilscomputerblog.blogspot.com/2012/06/stack-pivoting.html

Also, for XXX/actual constants (immediates) for SUB/ADD ESP XXX, you can always LEA a register then even MOV ESP, XXX/REG:

http://x86.renejeschke.de/html/file_module_x86_id_176.html

Last, depending on the DLL/EXE you're searching for gadgets in, if you can't easily ADD/SUB ESP you could do a slew of things (using volatile registers):

;ADD SEMANTICS EQUIVALENT 
POP ECX      ;semantically same as MOV EBXECX, ESP; ADD ESP 0x4
XOR ECX, ECX ;zeroes EBXECX if you wanna reuse the register

;SUB SEMANTICS EQUIVALENT
PUSH ECX     ;semantically same as MOV ESP, EBX;ECX; SUB ESP 0x4

You can even get fancy and mov values into a volatile register, SHL/SHR/ROL/ROR it and then use LEA/PUSH. It's all up to you to be creative!

Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the stack: https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#chainingbasics http://neilscomputerblog.blogspot.com/2012/06/stack-pivoting.html

Also, for XXX/actual constants (immediates) for SUB/ADD ESP XXX, you can always LEA a register then even MOV ESP, XXX/REG:

http://x86.renejeschke.de/html/file_module_x86_id_176.html

Last, depending on the DLL/EXE you're searching for gadgets in, if you can't easily ADD/SUB ESP you could do a slew of things (using volatile registers):

;ADD SEMANTICS EQUIVALENT 
POP ECX      ;semantically same as MOV EBX, ESP; ADD ESP 0x4
XOR ECX, ECX ;zeroes EBX if you wanna reuse the register

;SUB SEMANTICS EQUIVALENT
PUSH ECX     ;semantically same as MOV ESP, EBX; SUB ESP 0x4

You can even get fancy and mov values into a volatile register, SHL/SHR/ROL/ROR it and then use LEA/PUSH. It's all up to you to be creative!

Assuming you're building a ROP chain that needs to manipulate the stack, you can always go for semantically equivalent gadgets, e.g. PUSH/POP, MOV ESP XXX, (SUB,ADD) ESP instructions to build the stack: https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#chainingbasics http://neilscomputerblog.blogspot.com/2012/06/stack-pivoting.html

Also, for XXX/actual constants (immediates) for SUB/ADD ESP XXX, you can always LEA a register then even MOV ESP, XXX/REG:

http://x86.renejeschke.de/html/file_module_x86_id_176.html

Last, depending on the DLL/EXE you're searching for gadgets in, if you can't easily ADD/SUB ESP you could do a slew of things (using volatile registers):

;ADD SEMANTICS EQUIVALENT 
POP ECX      ;semantically same as MOV ECX, ESP; ADD ESP 0x4
XOR ECX, ECX ;zeroes ECX if you wanna reuse the register

;SUB SEMANTICS EQUIVALENT
PUSH ECX     ;semantically same as MOV ESP, ECX; SUB ESP 0x4

You can even get fancy and mov values into a volatile register, SHL/SHR/ROL/ROR it and then use LEA/PUSH. It's all up to you to be creative!

1
source | link