During the exploitation of a binary, I wish know what is the difference between the ROP (Return-oriented programming) and the ret2libc ?

I haven't found a resource which answer this question

Thank you

1 Answer 1


Essentially ret2libc is somewhat a ROP exploit, since you create a new stackframe to call the system function by returning to the libc library and circumventing a non-executable stack.

A ROP in general works similar, you jump to fragments of code (called gadgets) that return at some point and "build" yourself the code you want to execute by combining those fragments. You literally program the code you want to execute, creating new routines that were not in the code before. ret2libc utilizes the system function to get a shell.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .