2

I'm trying to understand ROP and struggle with the following two questions:

  • I'm often reading that ROP bypasses ASLR and DEP. While it's clear to me ROP is a perfect way to avoid DEP, I don't see how it's bypassing ASLR. Is it because the code section is not randomized?

  • I'm also reading a lot about these pop/pop/ret gadgets but I don't understand why they are needed. isn't any gadget ending in a ret good enough?

5

ROP is only a bypass for DEP - ASLR actually is the protection against ROP. The code section is randomized and that's why you can't (normally) use ROP against ASLR - to bypass it using ROP, you'll need an information leakage which discloses how the address space was changed.

As for the pop/pop/ret gadgets, these are used in the context of using SEH for code execution - a means of bypassing some analysis/protection methods other than DEP and ASLR.

Here's an explanation for POP,POP,RET in the context of SEH: https://dkalemis.wordpress.com/2010/10/27/the-need-for-a-pop-pop-ret-instruction-sequence/. As for ROP, the best resource I know of are Corelan's tutorials: https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube

  • Thank you for your post - I was still quite confused because I was always told ASLR does not randomize the code section. I think this confusion arised because of PIE (position independent executables). Some resources threat them as distinct technologies and ASLR it self does not randomize the code section, but PIE does. But it seems that they go hand-in-hand nowadays? Anyway thank you, I guess it's much clearer to me now. – user66875 Jun 24 '17 at 23:15
  • 1
    It's more of a per-platform discussion. Under Windows, for example, some memory locations are randomized across runs, others (including code) across reboots. Under Linux, a decision was made to not make all executables PIE because of performance issues (this is slowly changing now with PIE being enabled by default under the different platforms). Fedora, for example, requires PIE as hardening for some very important packages: fedoraproject.org/wiki/Hardened_Packages. However, most systems are slowly turning towards enabling PIE by default. – AdrianH Jun 26 '17 at 5:36
  • 1
    I just realized that I forgot to add: PIE is required for ASLR to work for the code section under Linux. So they're different things that belong together - you can do ASLR without PIE and have the code non-randomized (just stack, heap, shared libraries), ASLR with PIE to also randomize the text segment. This should explain it better: openbsd.org/papers/asiabsdcon2015-pie-slides.pdf – AdrianH Jun 26 '17 at 6:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.