My question is about the Blind ROP attack as described in the original paper. When probing for potential gadgets with the help of a stop gadget, how does one know for sure that the guessed address really points to a pop gadget and the likes and not to another STOP gadget? In essence, how does one reduce the occurrence of false positives in the gadgets "found" by probing the target system?

  • 1
    Isn't the idea to keep probing so that you can identify the correct gadget by the way it behaves? – Ian Sep 12 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.