pop rdi; ret. We can manipulate the
retof these gadgets in such a way as to string together a large chain of them to do what we want.
pop rdi; retgadget.
0x10gets popped into
rdias it is at the top of the stack during the
pop rdi. Once the
retis equivalent to
0x5655576724gets moved into
rip. Note how the stack is laid out for this.
rsp. Once that value is popped, it points at the next value at the stack - but wait. We can overwrite the next value in the stack.
pop rdi; retgadget, pop
rdithen jump to
flag(). Let's step-by-step the execution.
ret, which we overwrite the return pointer for, we pop the gadget address in. Now
ripmoves to point to the gadget, and
rspmoves to the next memory address.
rspmoves to the
pop rdi. Now when we pop,
0x100gets moved into
retis executed and
ret). If we want to pop
rdiand then jump to
0x16, our payload would look like this:
popinstructions, you can just add more values.
grepto look for specific registers.