A ROP Primer

Presented at CarolinaCon 13 (2017), May 21, 2017, 10 a.m. (60 minutes)

When writing exploits these days, stack protection techniques can be a pain in the ass. Return Oriented Programming (ROP) is a technique that allows you to evade stack protection and in certain cases even turn it off. In this talk we'll discuss what ROP is, how it works and some tips to get you writing ROP chains for your own exploits.

Presenters:

• Pandatrax
  Pandatrax is a security engineer at a large financial services company. He learned to program using BASIC on an Apple IIc and his first home computer was a used Atari 400. He uses vi on a regular basis and can't find his way out of nano.

Links:

• https://infocon.org/cons/CarolinaCon/CarolinaCon 13 2017/A ROP Primer - Pandatrax.mp4
• https://infocon.org/cons/CarolinaCon/CarolinaCon 13 2017/A ROP Primer - Pandatrax.srt (subtitles)
• https://www.youtube.com/watch?v=iNO2dT21USc

Similar Presentations:

• ShmooCon X (2014) / unROP: A Tool for In-Memory ROP Exploitation Detection and Traceback
• Black Hat USA 2010 / Payload Already Inside: Data Re-Use for ROP exploits
• DEF CON 27 (2019) / Exploiting Windows Exploit Mitigation for ROP Exploits