ROP gadget finder
Search a binary for return-oriented programming gadgets, filter by the registers they touch, and exclude ones containing bad bytes.
Open in ctfpalNX makes injected code non-executable, so ROP reuses code that is already there. A gadget is any short instruction sequence ending in ret; chaining them lets you compute arbitrary things using only code the program already contains.
The gadgets you actually need
For the common case - calling a function with controlled arguments on x86-64 - you need very little. The System V calling convention passes the first six integer arguments in RDI, RSI, RDX, RCX, R8, R9, so a pop rdi ; ret and a pop rsi ; ret cover most single- and double-argument calls.
| Gadget | Purpose |
|---|---|
pop rdi ; ret | First argument - the one every ret2libc needs |
pop rsi ; ret | Second argument |
pop rdx ; ret | Third - often scarce, which is why execve chains are harder |
ret | Stack alignment before a libc call |
syscall ; ret | Direct syscalls without libc |
leave ; ret | Stack pivot to a buffer you control |
Part of a module
10. Binary exploitation
Read a binary’s protections, find an overflow offset in one crash, and build a ROP chain when the stack is not executable.
Practise on real challenges
Go deeper
- From crash to shell: stack overflows, offsets, ret2win, and ret2libcA segfault is not an exploit. The path from an unexpected crash to a controlled instruction pointer to a shell, with the mitigation checks that decide which technique you need and the stack-alignment detail that breaks working exploits.
Related tools
ROP chain and payload builder
Assemble an exploit payload from padding, addresses, and raw bytes, with a live hexdump and offset ruler - the pwntools flat() workflow.
ELF, PE and Mach-O binary analyzer
Parse headers, sections, imports, and symbols from Linux, Windows, and macOS binaries, with C++ symbol demangling and gadget discovery.
Libc base address calculator
Turn a leaked libc pointer into the library’s base address, then resolve any other symbol - the arithmetic every ret2libc exploit runs on.
Shellcode assembler and library
Assemble x86 and x86-64 shellcode, or pick a ready execve(/bin/sh) payload, with null-byte-free variants and length reporting.