I was reading this article by the InfoSec institute:
And was able to follow along until he did the ROP Chain.
He finds the offset of printf and execve to be 328160
He then finds the following ROP gadgets:
0x804886eL: add eax [ebx-0xb8a0008] ; add esp 0x4 ; pop ebx 0x804861fL: call eax ; leave ;; 0x804849cL: pop eax ; pop ebx ; leave ;;
I understand that the idea is to load the absolute address of execve into eax and then call eax, but where i get lost is the way he does it.
0x804886eL: add eax [ebx-0xb8a0008] ; add esp 0x4 ; pop ebx
Adds eax and [ebx - 0xb8a0008] and then stores it in eax for the next gadget to call.
The goal now seems to be to get ebx to contain the absolute address of printf@got, but instead he loads 0x138e9ff4 into ebx, he says its because:
printf@got + 0xb8a0008 = 0x138e9ff4
I just have no idea how he calculates the value 0x138e9ff4, as ASLR is enabled and printf@got should be different every time, and therefore the value loaded into ebx should too.
Would appreciate any input you have