pop <reg>
gadget, you can then use this xchg
gadget to swap the values with the ones in RSP. Requires about 16 bytes of stack space after the saved return pointer:main
) is ended with a leave; ret
gadget. leave
is equivalent torbp
using leave
. How does that help us?leave
again, we noticed the value in RBP gets moved to RSP! So if we call overwrite RBP then overwrite RIP with the address of leave; ret
again, the value in RBP gets moved to RSP. And, even better, we don't need any more stack space than just overwriting RIP, making it very compressed.