skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-return-oriented-programming

Builds ROP chains to bypass NX/DEP using gadget discovery, ret2libc, and ret2syscall techniques.

954|172|Updated Mar 13, 2026
Search Tags:#pwntools#gadget#binary-exploitation#pwn#rop#ret2libc#nx-bypass
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-return-oriented-programming
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-return-oriented-programming
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/binary-exploitation/performing-return-oriented-programming
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-return-oriented-programming

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

When a stack overflow gives you control of the return address but NX/DEP prevents executing injected shellcode, this Skill provides the methodology to hijack execution by chaining existing code gadgets into a working exploit.

Core Features & Use Cases

  • Gadget Discovery & Chain Building: Find pop rdi; ret-style gadgets with ROPgadget, ropper, and pwntools, then assemble chains that respect calling conventions and 16-byte stack alignment.
  • Multiple Exploitation Paths: Covers ret2libc (calling system), ret2syscall (raw execve in static binaries), one_gadget, SROP, JOP, and stack pivoting for constrained overflows.
  • Architecture Awareness: Handles x86, x86-64 SysV, Windows x64, and ARM64 differences, including the ARM64 second-instruction entry pitfall.
  • Use Case: During an authorized engagement against an NX-enabled x86-64 binary, leak libc via puts(puts@got), fingerprint the version, then send a second-stage chain calling system("/bin/sh") with proper alignment to obtain a shell.

Quick Start

Use this skill to build a ROP chain that exploits the stack overflow in the target binary and spawns a shell despite NX being enabled.

Frequently Asked Questions about performing-return-oriented-programming

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a ROP chain to bypass NX/DEP?▼

Find gadgets ending in ret with ROPgadget or ropper, then chain them to load argument registers (pop rdi; ret on x86-64) and call a function like system or invoke a syscall. pwntools' ROP class automates gadget lookup and chain assembly.

What is the difference between ret2libc and ret2syscall?▼

ret2libc calls an existing libc function such as system with crafted arguments, while ret2syscall sets registers directly (rax=59, rdi, rsi, rdx) and executes a raw syscall instruction. ret2syscall is common in statically linked binaries with abundant gadgets.

Why does my ROP chain crash inside system() on x86-64?▼

The SysV ABI requires RSP to be 16-byte aligned at a call, and libc functions use SSE instructions like movaps that fault on misalignment. Insert a bare ret gadget before the function call to realign the stack.

How do I exploit a binary when the libc version is unknown?▼

Leak a runtime address first, for example by ROP-calling puts(puts@got), then fingerprint the libc version online using the leaked offset. Rebase libc with libc.address = leak - libc.symbols['puts'] and send a second-stage chain.

Can ROP work on ARM64 binaries?▼

ARM64 rarely offers useful ret gadgets, so use JOP gadgets ending in br xN or a stack pivot such as mov sp, x0. When jumping to a function, target its second instruction to avoid re-storing the stack pointer and looping.

What tools find ROP gadgets in a binary?▼

ROPgadget enumerates gadgets and can auto-generate execve chains with --ropchain, ropper offers semantic search across binaries and shared libraries, and pwntools' ROP class integrates gadget finding directly into exploit scripts.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.7k

binary-exploitation-methodology

Guides analysis and exploitation of binary vulnerabilities including stack overflows, heap corruption, and format strings.

Official
Advanced
transilienceaitransilienceai
462

web-application-pentesting

Coordinate web application penetration testing across REST APIs, SPAs, and microservices.

Official
Basic
bingookbingook

format-string-exploitation

Exploit format string vulnerabilities for stack reads and arbitrary writes.

Community
Advanced
alicangnllalicangnll

ROP Chain Builder

Automate ROP chain construction to bypass DEP/NX protections.

Community
Advanced