With return-oriented programming, when we fill a buffer with the stack contents (arguments and return addresses) for the function calls we plan on "injecting," how do we actually change the stack pointer to point to this buffer before we start our attack?

Can anyone properly explain what Return-Oriented Programming is?

closed as too broad by Steffen Ullrich, schroeder Mar 27 at 22:18

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


The video @schroeder linked too is great. Maybe you need a simpler explanation though.

Data execution prevention is software or hardware that monitors the location of executable code in memory. It is useful because if you ran malicious code from a part of memory reserved for trusted programs, it would be harder to detect. Windows keeps track of memory to prevent that from happening, so in most cases it is the data execution prevention.

Return Oriented Programming is exploiting a trusted program to execute malicious code from memory in order to evade the data execution prevention in Windows or whatever OS you use.

Windows will say some parts of memory are only for non executable code, which means the code there will not be treated as instructions by the processor. ROP uses the Windows API to make the section of memory with the malicious code executable, so it will be ran by the processor.

Not the answer you're looking for? Browse other questions tagged or ask your own question.