0Pricing
Cyber Security Academy · Lesson

Return-Oriented Programming (ROP)

Chain ROP gadgets to bypass NX/DEP and build shellcode-free exploits.

Return-Oriented Programming (ROP) is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why ROP Exists

With NX/DEP, injected shellcode cannot execute. Return-Oriented Programming (ROP) bypasses this by chaining small existing code sequences (gadgets) that end with ret instructions. No new code is injected — only the stack and existing code are used.

What is a ROP Gadget?

A gadget is a short sequence of instructions ending in ret, found in the binary or loaded libraries. Examples: pop rdi; ret, pop rsi; ret, mov eax, 0; ret. Gadgets are the building blocks of ROP chains.

Finding Gadgets

Tools to find ROP gadgets in binaries:

# ROPgadget:
ROPgadget --binary ./vuln --rop
# ropper:
ropper -f ./vuln --search "pop rdi"
# pwntools:
from pwn import *
elf = ELF("./vuln")
rop = ROP(elf)
rop.find_gadget(["pop rdi", "ret"])

Building a ROP Chain

A ROP chain is a sequence of return addresses on the stack. When the overwritten return address is hit, it jumps to gadget 1 (which does something useful, then rets), which pops the next address and jumps to gadget 2, and so on.

ret2plt and GOT Overwrite

ret2plt calls functions via the PLT (Procedure Linkage Table) — useful for calling puts() to leak libc addresses, then using those to call system(). The PLT/GOT structures are predictable even with ASLR for the main binary (without PIE).

Defeating ASLR with ROP

ROP can leak a libc function address from the GOT using a gadget that calls puts(GOT_entry). The leaked address reveals the libc base. Calculate system() offset: system_addr = leak - libc.symbols["puts"] + libc.symbols["system"].

SROP: Sigreturn-Oriented Programming

SROP uses the sigreturn syscall to load a fake sigcontext frame, setting all registers to attacker-controlled values in one gadget. Useful when few gadgets are available.

JOP and COP Variants

Beyond ROP:

  • JOP (Jump-Oriented Programming) — chains gadgets ending in jmp instead of ret
  • COP (Call-Oriented Programming) — chains gadgets ending in call

Defenses like CFI (Control Flow Integrity) aim to prevent all these.

Control Flow Integrity (CFI)

CFI enforces that indirect branches (calls, returns) only jump to valid targets. It breaks ROP by validating the return target against a shadow stack or an allowlist. Intel CET (Control-flow Enforcement Technology) implements hardware-level CFI.

Practical ROP Example

A 64-bit ret2libc via ROP:

# pwntools ROP chain example:
from pwn import *
p = process("./vuln")
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
elf = ELF("./vuln")
rop = ROP(elf)
# Leak puts GOT to get libc base
rop.puts(elf.got["puts"])
rop.main()

Mitigations Summary

Protections against ROP:

  • CFI — validates branch targets
  • Shadow stack (CET) — hardware-protected return address copy
  • RELRO (full) — makes GOT read-only, prevents overwrites
  • PIE — randomizes binary base, requires a leak to find gadgets

Quick Check: ROP

What is a ROP gadget?

Lesson Recap

ROP bypasses NX/DEP by chaining existing code sequences (gadgets ending in ret) — no shellcode injection needed. Gadget-finding tools: ROPgadget, ropper. ret2plt leaks libc addresses to defeat ASLR. Defenses: CFI, shadow stacks (Intel CET), PIE, full RELRO. ROP is the foundation of modern binary exploitation.

Frequently asked questions

Is the “Return-Oriented Programming (ROP)” lesson free?

Yes — the full text of “Return-Oriented Programming (ROP)” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Return-Oriented Programming (ROP)”?

Chain ROP gadgets to bypass NX/DEP and build shellcode-free exploits. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Return-Oriented Programming (ROP)” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Stack Buffer Overflows
  2. Return-Oriented Programming (ROP)
  3. Format String Vulnerabilities
  4. Heap Exploitation: Use-After-Free and Heap Spraying
← Back to Cyber Security Academy