Lecture 14 Return-oriented programming Stephen Checkoway Oberlin - - PowerPoint PPT Presentation

▶
lecture 14 return oriented programming
SMART_READER_LITE
LIVE PREVIEW

Lecture 14 Return-oriented programming Stephen Checkoway Oberlin - - PowerPoint PPT Presentation

Jun 27, 2023 816 likes •1.64k views

Lecture 14 Return-oriented programming Stephen Checkoway Oberlin College Based on slides by Bailey, Brumley, and Miller ROP Overview Idea: We forge shellcode out of existing application logic gadgets Requirements: vulnerability +

slide-1
SLIDE 1

Lecture 14 – Return-oriented programming

Stephen Checkoway Oberlin College Based on slides by Bailey, Brumley, and Miller

slide-2
SLIDE 2

ROP Overview

  • Idea: We forge shellcode out of existing application logic gadgets
  • Requirements:

vulnerability + gadgets + some unrandomized code

  • History:
  • No code randomized: Code injection
  • DEP enabled by default: ROP attacks using libc gadgets published 2007
  • ROP assemblers, compilers, shellcode generators
  • ASLR library load points: ROP attacks use .text segment gadgets
  • Today: all major OSes/compilers support position-independent executables

2

slide-3
SLIDE 3

3

Image by Dino Dai Zovi

slide-4
SLIDE 4

ROP Programming

  • 1. Disassemble code (library or program)
  • 2. Identify useful code sequences (usually ending in ret)
  • 3. Assemble the useful sequences into reusable gadgets*
  • 4. Assemble gadgets into desired shellcode

* Forming gadgets is mostly useful when constructing complicated return-oriented shellcode by hand

4

slide-5
SLIDE 5

A note on terminology

  • When ROP was invented in 2007
  • Sequences of code ending in ret were the basic building blocks
  • Multiple sequences and data are assembled into reusable gadgets
  • Subsequently
  • A gadget came to refer to any sequence of code ending in a ret
  • In 2010
  • ROP without returns (e.g., code sequences ending in call or jmp)
slide-6
SLIDE 6

There are many semantically equivalent ways to achieve the same net shellcode effect

6

slide-7
SLIDE 7

... v2 ... v1 a1: mov eax, [esp] a2: mov ebx, [esp+8] a3: mov [ebx], eax Implementation 1

Equivalence

7

Desired Logic Stack

Mem[v2] = v1

esp

slide-8
SLIDE 8

Constant store gadget

8

Desired Logic a5 v2 a3 v1 Stack

Mem[v2] = v1

a1: pop eax; a2: ret a3: pop ebx; a4: ret a5: mov [ebx], eax

Implementation 2

Suppose a5 and a3 on stack

esp

eax ebx eip v1 a1

slide-9
SLIDE 9

Constant store gadget

9

Desired Logic a5 v2 a3 v1 Stack

Mem[v2] = v1

a1: pop eax; a2: ret a3: pop ebx; a4: ret a5: mov [ebx], eax

Implementation 2

esp

eax ebx eip v1 a1 a3

slide-10
SLIDE 10

Constant store gadget

10

Desired Logic a5 v2 a3 v1 Stack

Mem[v2] = v1

a1: pop eax; a2: ret a3: pop ebx; a4: ret a5: mov [ebx], eax

Implementation 2

esp

eax ebx eip v1 a3 v2

slide-11
SLIDE 11

Constant store gadget

11

Desired Logic a5 v2 a3 v1 Stack

Mem[v2] = v1

a1: pop eax; a2: ret a3: pop ebx; a4: ret a5: mov [ebx], eax

Implementation 2

esp

eax ebx eip v1 a4 a5 v2

slide-12
SLIDE 12

Constant store gadget

12

Desired Logic a5 v2 a3 v1 Stack

Mem[v2] = v1

a1: pop eax; a2: ret a3: pop ebx; a4: ret a5: mov [ebx], eax

Implementation 2

esp

eax ebx eip v1 a5 v2

slide-13
SLIDE 13

Equivalence

13

Desired Logic a3 v2 a2 v1 Stack

Mem[v2] = v1

a1: mov eax, [esp] a2: mov ebx, [esp+8] a3: mov [ebx], eax Implementation 1 a1: pop eax; ret a2: pop ebx; ret a3: mov [ebx], eax Implementation 2

semantically equivalent

esp

slide-14
SLIDE 14

Return-Oriented Programming

  • Find needed instruction

gadgets at addresses a1, a2, and a3 in existing code

  • Overwrite stack to execute a1,

a2, and then a3

14

Desired Shellcode

Mem[v2] = v1

… argv argc return addr caller’s ebp buf (64 bytes) argv[1] buf %ebp %esp

slide-15
SLIDE 15

Return-Oriented Programming

15

Desired Shellcode

Mem[v2] = v1

… argv argc return addr caller’s ebp buf (64 bytes) argv[1] buf %ebp %esp a3 v2 a2 v1 a1

a1: pop eax; ret a2: pop ebx; ret a3: mov [ebx], eax

Desired store executed!

slide-16
SLIDE 16

Arithmetic/logical operations: c = x op y

Basic strategy

  • 1. Pop the address of one variable into a register
  • 2. Load the value of the variable into a register
  • 3. Pop the address of another variable into a register
  • 4. Load the value of the variable into a register
  • 5. Perform the operation
  • 6. Pop the address of the destination variable into a register
  • 7. Store the result of the operation at that address

Must be mindful of register interactions

slide-17
SLIDE 17

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Stack contains

  • Addresses of code

snippets ending in ret

  • Data (here, the

addresses of our variables)

slide-18
SLIDE 18

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax 105 ebx 3852

slide-19
SLIDE 19

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax 105 ebx 3852

slide-20
SLIDE 20

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax &y ebx 3852

slide-21
SLIDE 21

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax &y ebx 3852

slide-22
SLIDE 22

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax &y ebx y

slide-23
SLIDE 23

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax &y ebx y

slide-24
SLIDE 24

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax &x ebx y

slide-25
SLIDE 25

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax &x ebx y

slide-26
SLIDE 26

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax x ebx y

slide-27
SLIDE 27

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax x ebx y

slide-28
SLIDE 28

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax x ebx y + x

slide-29
SLIDE 29

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax x ebx y + x

slide-30
SLIDE 30

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax &c ebx y + x

slide-31
SLIDE 31

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax &c ebx y + x

slide-32
SLIDE 32

Arithmetic

  • Addition: c = x + y
  • popl %eax

ret

  • movl (%eax), %eax

ret

  • movl (%eax), %ebx

ret

  • addl %eax, %ebx

ret

  • movl %ebx, (%eax)

ret

esp &c &x &y Register Value eax &c ebx y + x

slide-33
SLIDE 33

What else can we do?

  • Depends on the code we have access to
  • Usually: Arbitrary Turing-complete behavior
  • Arithmetic
  • Logic
  • Conditionals and loops
  • Subroutines
  • Calling existing functions
  • System calls
  • Sometimes: More limited behavior
  • Often enough for straight-line code and system calls
slide-34
SLIDE 34

Comparing ROP to normal programming

Normal programming ROP Instruction pointer eip esp No-op nop ret Unconditional jump jmp address set esp to address of gadget Conditional jump jnz address set esp to address of gadget if some condition is met Variables memory and registers mostly memory Inter-instruction (inter-gadget) register and memory interaction minimal, mostly explicit; e.g., adding two registers only affects the destination register can be complex; e.g., adding two registers may involve modifying many registers which impacts other gadgets

slide-35
SLIDE 35

Return-oriented conditionals

  • Processors support instructions that conditionally change the PC
  • On x86
  • Jcc family: jz, jnz, jl, jle, etc. 33 in total
  • loop, loope, loopne
  • Based on condition codes mostly; and on ecx for some
  • On MIPS
  • beq, bne, blez, etc.
  • Based on comparison of registers
  • Processors generally don’t support for conditionally changing the

stack pointer (with some exceptions)

slide-36
SLIDE 36

We want conditional jumps

  • Unconditional jump addr
  • popl %eax

ret

  • movl %eax, %esp

ret

slide-37
SLIDE 37

We want conditional jumps

  • Unconditional jump addr
  • popl %eax

ret

  • movl %eax, %esp

ret

esp ... &next gadget addr

slide-38
SLIDE 38

We want conditional jump

  • Unconditional jump addr
  • popl %eax

ret

  • movl %eax, %esp

ret

esp ... &next gadget addr

slide-39
SLIDE 39

We want conditional jump

  • Unconditional jump addr
  • popl %eax

ret

  • movl %eax, %esp

ret

esp ... &next gadget addr eax

slide-40
SLIDE 40

We want conditional jumps

  • Unconditional jump addr
  • popl %eax

ret

  • movl %eax, %esp

ret

esp ... &next gadget addr eax

slide-41
SLIDE 41

We want conditional jumps

  • Unconditional jump addr
  • popl %eax

ret

  • movl %eax, %esp

ret

... &next gadget addr eax, esp

slide-42
SLIDE 42

We want conditional jumps

  • Unconditional jump addr
  • popl %eax

ret

  • movl %eax, %esp

ret

... &next gadget addr eax esp

slide-43
SLIDE 43

We want conditional jumps

  • Unconditional jump addr
  • popl %eax

ret

  • movl %eax, %esp

ret

  • Conditional jump addr, one way
  • Conditionally set a register to 0 or 0xffffffff
  • Perform a logical AND with the register and an offset
  • Add the result to esp
slide-44
SLIDE 44

Conditionally set a register to 0 or 0xffffffff

  • Compare registers eax and ebx and set ecx to
  • 0xffffffff if eax < ebx
  • 0 if eax >= ebx
  • Ideally we would find a sequence like

cmpl %ebx, %eax set carry flag cf according to eax - ebx sbbl %ecx, %ecx ecx ← ecx - ecx - cf; or ecx ← -cf ret

  • Unlikely to find this; instead look for cmp; ret and sbb; ret sequences
slide-45
SLIDE 45

Performing a logical AND with a constant

  • Pop the constant into a register using pop; ret
  • Use an and; ret sequence
slide-46
SLIDE 46

Updating the stack pointer

  • Use an add esp; ret sequence
slide-47
SLIDE 47

Putting it together

... &next gadget 37 addr 42

  • ffset

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret

Conditional jump Load constant in edx Unconditional jump

Useful instruction sequences

slide-48
SLIDE 48

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 10 ebx 20 ecx 108 edx 17 esp

slide-49
SLIDE 49

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 10 ebx 20 ecx 108 edx 17 esp

slide-50
SLIDE 50

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 10 ebx 20 ecx 108 edx 17 esp cf = 1

slide-51
SLIDE 51

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 10 ebx 20 ecx 108 edx 17 esp cf = 1

slide-52
SLIDE 52

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 10 ebx 20 ecx 0xffffffff edx 17 esp cf = 1

slide-53
SLIDE 53

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 10 ebx 20 ecx 0xffffffff edx 17 esp

slide-54
SLIDE 54

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 20 = offset ebx 20 ecx 0xffffffff edx 17 esp

slide-55
SLIDE 55

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 20 = offset ebx 20 ecx 0xffffffff edx 17 esp

slide-56
SLIDE 56

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 20 = offset ebx 20 ecx 0xffffffff edx 17 esp

slide-57
SLIDE 57

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 20 = offset ebx 20 ecx 0xffffffff edx 17 esp

slide-58
SLIDE 58

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 20 = offset ebx 20 ecx 0xffffffff edx 17 esp

slide-59
SLIDE 59

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 20 = offset ebx 20 ecx 0xffffffff edx 17 esp

slide-60
SLIDE 60

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 20 = offset ebx 20 ecx 0xffffffff edx 37 esp

slide-61
SLIDE 61

... &next gadget 37 addr 42

  • ffset

Putting it together

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 20 = offset ebx 20 ecx 0xffffffff edx 37 esp

slide-62
SLIDE 62

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 500 ebx 20 ecx 108 edx 17 esp

slide-63
SLIDE 63

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 500 ebx 20 ecx 108 edx 17 esp

slide-64
SLIDE 64

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 500 ebx 20 ecx 108 edx 17 esp cf = 0

slide-65
SLIDE 65

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 500 ebx 20 ecx 108 edx 17 esp cf = 0

slide-66
SLIDE 66

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 500 ebx 20 ecx edx 17 esp

slide-67
SLIDE 67

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 500 ebx 20 ecx edx 17 esp

slide-68
SLIDE 68

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 20 = offset ebx 20 ecx edx 17 esp

slide-69
SLIDE 69

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax 20 = offset ebx 20 ecx edx 17 esp

slide-70
SLIDE 70

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax ebx 20 ecx edx 17 esp

slide-71
SLIDE 71

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax ebx 20 ecx edx 17 esp

slide-72
SLIDE 72

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax ebx 20 ecx edx 17 esp

slide-73
SLIDE 73

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax ebx 20 ecx edx 17 esp

slide-74
SLIDE 74

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax ebx 20 ecx edx 42 esp

slide-75
SLIDE 75

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax ebx 20 ecx edx 42 esp

slide-76
SLIDE 76

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax addr ebx 20 ecx edx 42 esp

slide-77
SLIDE 77

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax addr ebx 20 ecx edx 42 esp

slide-78
SLIDE 78

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax addr ebx 20 ecx edx 42 esp

slide-79
SLIDE 79

... &next gadget 37 addr 42

  • ffset

And again!

cmpl %ebx, %eax ret sbbl %ecx, %ecx ret popl %eax ret andl %ecx, %eax ret addl %eax, %esp ret popl %edx ret movl %eax, %esp ret Register Value eax addr ebx 20 ecx edx 42 esp

slide-80
SLIDE 80

Compare

Register Value eax 10 ebx 20 ecx 108 edx 17 Register Value eax addr ebx 20 ecx edx 42 Register Value eax 500 ebx 20 ecx 108 edx 17 Register Value eax 20 ebx 20 ecx 0xffffffff edx 37 if (eax < ebx) edx = 37; else edx = 42;