Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
With return-oriented programming, when we fill a buffer with the stack contents (arguments and return addresses) for the function calls we plan on "injecting," how do we actually change the stack pointer to point to this buffer before we start our attack?
Can anyone properly explain what Return-Oriented Programming is?
The video @schroeder linked too is great. Maybe you need a simpler explanation though.
Data execution prevention is software or hardware that monitors the location of executable code in memory. It is useful because if you ran malicious code from a part of memory reserved for trusted programs, it would be harder to detect. Windows keeps track of memory to prevent that from happening, so in most cases it is the data execution prevention.
Return Oriented Programming is exploiting a trusted program to execute malicious code from memory in order to evade the data execution prevention in Windows or whatever OS you use.
Windows will say some parts of memory are only for non executable code, which means the code there will not be treated as instructions by the processor. ROP uses the Windows API to make the section of memory with the malicious code executable, so it will be ran by the processor.
