I noticed that exploits which use Return Oriented Programming always find the gadgets in libraries. I wonder if it is possible to use gadgets from the executable (.exe) itself?

  • 2
    I think that is the point. The Executable and statically linked libraries are the source of ROP's, Dynamically linked libraries will be ASLR'ed – rook May 7 '13 at 18:34

I believe the reason is "it's easiest to use instruction sequences from the libraries, because the libraries are so common and they've already been scanned."

There are just a handful of Microsoft-provided C-runtime library files. If they provide a complete enough instruction set, why work harder?


Yes, absolutely, of course it is possible to use gadgets that are from the executable itself. You can use any code that is mapped into the address space of the program in executable form (i.e., where it's possible to execute the code -- if the system is using DEP, this excludes anything that has the non-executable bit set). That includes the original executables, any libraries that are loaded into memory, and anything else in memory that has its permissions set to executable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.