Why would legitimate programs have a `jmp esp` instruction?

Question

It appears that a common exploit trick is to use stack overflow to overwrite the instruction pointer such that it points to a jmp esp instruction somewhere in the code segment which then executes the arbitrary code of the attacker's choice.

However, I have a hard time understanding what use legitimate programs (which to my understanding are usually not self-modifying and have all of their executable code stored in the code segment) would have in including such jmp esp instructions in the first place.

Answer 1

The instruction jmp esp is encoded as FF E4. It’s not necessary to find an actual jmp instruction, just those bytes in the middle of any other code or data.

This is the basis for return oriented programming (ROP) and these small sequences of useful instructions are often called “ROP gadgets”.

Note this particular technique is easily broken by a non-executable stack. Requiring an executable stack is quite rare (outside specific cases like a JIT compiler) so this is a simple and effective mitigation. To get round this there are techniques like return-to-libc which chain a number of these small ROP gadgets to build a longer sequence of instructions.