What happens when overwriting a return isn't enough?

In C for Hackers you overwrote a return address to jump to a magic win(). Real targets are harder: the function you want needs arguments, and the stack is often non-executable (NX) so you can't just drop shellcode. The answer is Return-Oriented Programming (ROP): chain tiny snippets of existing code ("gadgets") to make the CPU do whatever you want — without injecting a single new instruction.

🎯 Your target

ls -la ~/ropme/
cat ~/ropme/rop.c        # win(key) prints the flag ONLY if key == 0xdeadc0de
~/ropme/rop <<< test     # try it — "wrong key"

🎯 Challenge: Read rop.c. Why can't a plain ret2win (jump straight to win) capture the flag here?

Show solution

Jumping to win leaves RDI (the 1st argument register) holding garbage, so key != 0xdeadc0de → "wrong key". You must set RDI first, then call win. That requires a gadget — i.e. ROP.

⚖️ Exploit only the lab binary or software you own.

Liked it? 8 more lessons are waiting.

9 lessons · knowledge checks · final exam · verifiable certificate · in-browser Live-Lab

Unlock all courses · CHF 9/month Buy only this course · CHF 19

What's in Exploit Development

1. Beyond ret2win — the Real ProblemFree
2. The Calling Convention (RDI, RSI, …)🔒 Foundations
3. What Is a ROP Gadget?🔒 ROP
4. Finding Gadgets🔒 ROP
5. Building the ROP Chain🔒 Exploitation
6. Why ROP Exists — NX / DEP🔒 Concepts
7. ASLR, PIE & the Need for Leaks🔒 Concepts
8. ret2libc & Popping a Shell (Concept)🔒 Concepts
9. Final Exam — Own ./rop with a Chain🔒 Certification

Continue in the interactive course reader →

Beyond ret2win — the Real Problem

What happens when overwriting a return isn't enough?

🎯 Your target

Liked it? 8 more lessons are waiting.

What's in Exploit Development