Some quick notes after uploading the video: - I forgot to include a good ROP reference from Exploit DB (Shaif El-Sherei): www.exploit-db.com/docs/english/28479-return-oriented-programming-(rop-ftw).pdf - A ROP gadget is any instruction sequence that ends with an instruction that modifies the RIP register, typically a RET (but it could be any other instruction, like JMP). In the video, in order to keep things simple, I mentioned only the RET case. - Yes, around 14:45 I mispronounce the word "contriving" :(
This is by far the clearest explanation of ROP ive ever seen and you are the only channel ive seen to break it down into the very basics, and make it super clear to understand. Glad to be one of your first 500 subs, but you deserve more than the big CTF youtubers out there and I can see your channel blowing up. Thanks a lot!
Every single one of your videos has taught me 10 x anything I have ever learned from any other instructor. Your approach with explaining each subject and all of the complex details is just phenomenal. So grateful to have stumbled across you. Working my way through your content and loving every minute.
Wow. I cant wait for your channel to explode! You have a deep understanding of what you're doing and present the material in a clear and approachable way. I really enjoyed this, thank you!
Hello! One of the best videos about ROPs. One thing I would like o mention: After: payload = b"A" * 0x28 I also need an address of just 'ret' got with ROPgadget so: payload += return_address. Moreover I need to push it further to "usefulFunction" address. So: payload += usefullFunction_address So now I can add the other 3 addresses that you have in your video. I don't know why it is not working with what you just present there...
@@RazviOverflow I am saying that on my end, it doesn't work just with those 3 added addresses to the payload. I need 2 more (1 of a ret address and the address of the "usefulFunction")
Possibly already pointed out - at around 8:30 the picture of the stack being overflowed is backwards. The stack grows from high memory addresses to low. Everything that was drawn into the stack should be flipped upside down. Nonetheless, still a great video and explanation.
Incorrect. As you stated, stack grows from higher (H) addresses toward lower (L) ones. At the right of the drawing there is a huge arrow that goes downwards from H to L to indicate just that. There is no such thing as flipping the stack upside down. It doesn't matter how you draw it as long as you specify where the higher or lower addresses are. If you check the whole series from the beginning or the process I usually follow to draw the stack, you will notice I always do it like so. Thanks for the comment.
Can you make a Cutter setup video. My cutter shows addresses relative to stack. Which is pretty confusing... I was wondering why isn't my exploit working... It shows var void *buf @ stack - 0x28 whereas on yours it shows var void *buf @ rbp - 0x20 @14:53
They changed that in recent versions of cutter. I'm not sure if you can change it back to the older form (like in my video). Anyways, you just have to realize that what they call "stack" is the base stack address (right where the saved return address ends), and right above it lies the rbp. So rbp-0x20 and stack-0x28 are equivalent given that rbp is 8 bytes long.
@@RazviOverflow Just look at the illustration at 12:30, it may be not even your fault, just assembly is ... insane, everything goes everywhere all the time and i fail to map this in my brain
