Binary exploitationRuns locallyNo account
ROP gadget finder
Search a binary for return-oriented programming gadgets, filter by the registers they touch, and exclude ones containing bad bytes.
Open in ctfpalNX makes injected code non-executable, so ROP reuses code that is already there. A gadget is any short instruction sequence ending in ret; chaining them lets you compute arbitrary things using only code the program already contains.
The gadgets you actually need
For the common case - calling a function with controlled arguments on x86-64 - you need very little. The System V calling convention passes the first six integer arguments in RDI, RSI, RDX, RCX, R8, R9, so a pop rdi ; ret and a pop rsi ; ret cover most single- and double-argument calls.
| Gadget | Purpose |
|---|---|
pop rdi ; ret | First argument - the one every ret2libc needs |
pop rsi ; ret | Second argument |
pop rdx ; ret | Third - often scarce, which is why execve chains are harder |
ret | Stack alignment before a libc call |
syscall ; ret | Direct syscalls without libc |
leave ; ret | Stack pivot to a buffer you control |