I'm trying to understand ROP and struggle with the following two questions:
I'm often reading that ROP bypasses ASLR and DEP. While it's clear to me ROP is a perfect way to avoid DEP, I don't see how it's bypassing ASLR. Is it because the code section is not randomized?
I'm also reading a lot about these pop/pop/ret gadgets but I don't understand why they are needed. isn't any gadget ending in a ret good enough?