stack-overflow-and-rop

A stack-based binary exploitation playbook for hijacking control flow of Linux userland programs through buffer overflows and return-oriented programming. It starts with stack layout fundamentals (the position of the return address, saved frame pointer, canary, and local buffer) and a table contrasting 32-bit and 64-bit specifics such as return-address size, calling convention (stack args versus RDI/RSI/RDX/RCX/R8/R9), and syscall instruction.

The techniques progress from return-to-libc (both 32-bit stack-argument style and 64-bit with pop-gadget argument setup) through full ROP chain construction. It compares gadget-finding tools (ROPgadget, ropper, pwntools ROP, xrop), lists essential gadget patterns for setting argument registers and pivoting, and highlights the x86-64 movaps stack-alignment requirement that a spare ret gadget fixes. Libc base leaking is covered with puts, write, and printf primitives plus partial overwrites, and one_gadget is shown with its constraint requirements. More advanced primitives include ret2csu for universal three-argument control via __libc_csu_init, ret2dlresolve to resolve a function like system without a libc leak (with a 32-bit versus 64-bit structure comparison and pwntools automation), SROP to set all registers at once from a forged signal frame, and stack pivoting when overflow length is limited.

Use it when a memory-corruption bug gives control of a saved return address and you need to turn that into code execution, typically in CTF or vulnerability-research contexts. The material is distilled from ctf-wiki, real-world CVEs, and competition patterns, and points to companion skills for format-string leaks, binary protection bypass (NX, ASLR, PIE, canary, RELRO), arbitrary-write-to-RCE conversion, and heap exploitation, plus an advanced reference covering Blind ROP, ret2vdso, partial-overwrite PIE bypass, and JOP/COP.