{"enrichment":{"faq":[{"a":"Stack Overflow & ROP teaches control-flow hijacking by overwriting return addresses on the stack. When a buffer overflows, attackers write past allocated memory into the return address (EIP on x86, RIP on x64), redirecting execution. Stack Overflow & ROP covers fundamentals, libc leaking strategies to defeat ASLR, and gadget selection for constructing exploit chains that bypass NX, ASLR, and canaries.","q":"What is stack overflow exploitation and how does it work?"},{"a":"Stack Overflow & ROP explains ROP chain construction by chaining short instruction sequences (gadgets) ending in `ret` to set registers and call functions. The skill covers gadget search tools like ROPgadget and ropper, constraint-based selection, and techniques like ret2csu for multi-argument calls on x86-64, enabling arbitrary code execution when direct jumps are blocked by NX.","q":"How do you construct ROP chains and gadget sequences for arbitrary code execution?"},{"a":"Stack Overflow & ROP covers ret2libc as a method to bypass NX by returning to existing libc functions instead of injected shellcode. The technique involves leaking libc addresses (via format strings or other means), calculating offsets, and chaining function calls. Stack Overflow & ROP teaches libc leaking strategies and how to construct arguments for functions like `system()` or `execve()` on both x86 and x64 architectures.","q":"What does return to libc bypass NX and how is it used?"},{"a":"Stack Overflow & ROP covers three advanced techniques: ret2csu uses `__libc_csu_init` gadgets to set arguments for x64 calls; ret2dlresolve exploits dynamic linking to resolve arbitrary functions without leaks; SROP (sigreturn-oriented programming) uses signal handlers to control all registers via `sigreturn` syscalls. Each bypasses specific protections in constrained exploitation scenarios.","q":"What are ret2csu, ret2dlresolve, and SROP attack methodologies?"},{"a":"Stack Overflow & ROP covers stack pivoting (using `leave; ret` gadgets to redirect the stack pointer) for exploits with limited overflow space, and canary bypass via brute-force (on local services), information leaks (format strings), or one-gadget RCE techniques. These methods enable exploitation when direct overflow is constrained by protections or buffer size limits.","q":"How do stack pivoting and canary bypass techniques work in overflow scenarios?"},{"a":"Stack Overflow & ROP compares gadget search tools (ROPgadget, ropper), discusses blind ROP (BROP) methodology for unknown binaries, and covers real-world CTF pwn patterns. The skill includes x86-64 calling convention details, EIP/RIP overwrite mechanics, heap vs. stack overflow distinctions, and practical exploitation workflows for Linux userland binaries with NX, ASLR, and canary protections.","q":"What tools and methodologies does Stack Overflow & ROP recommend for binary exploitation?"}],"shadow_tags":["code-reuse-attacks","memory-corruption","control-flow-hijacking","gadget-orchestration","protection-evasion","low-level-exploitation","binary-pwning","reverse-engineering","exploit-development","vulnerability-chaining"],"summary_rewrite":"Stack Overflow & ROP covers advanced control-flow hijacking via return address overwrite on Linux userland binaries. Learn buffer overflow fundamentals, libc leaking strategies, ROP gadget selection, ret2csu for multi-argument calls, ret2dlresolve for blind resolution, SROP for register control, and stack pivoting under constraints. Includes tool comparisons and real-world exploitation patterns."},"files":[{"bytes":11185,"path":"skills/stack-overflow-and-rop/SKILL.md","sha256":"f915394bc7aa096771f2f6d91aef09f705414f3c6376a7e2083de38b6eead0c7","url":"https://skillfed.io/files/yaklang/hack-skills/stack-overflow-and-rop/fe7c2746/SKILL.md"}],"id":"yaklang/hack-skills/stack-overflow-and-rop","links":{"html":"https://skillfed.io/yaklang/hack-skills/stack-overflow-and-rop","md":"https://skillfed.io/yaklang/hack-skills/stack-overflow-and-rop.md","repo":"https://github.com/yaklang/hack-skills"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":196,"language":"CSS","last_updated":"2026-06-16","license":"MIT","name":"stack-overflow-and-rop","publisher":"yaklang","stars":1480},"relations":{"similar":[{"id":"ljagiello/ctf-skills/ctf-pwn"},{"id":"yaklang/hack-skills/arbitrary-write-to-rce"},{"id":"CommonHuman-Lab/nyxstrike/binary-analysis"},{"id":"yaklang/hack-skills/binary-protection-bypass"},{"id":"cyberkaida/reverse-engineering-assistant/ctf-pwn"},{"id":"mohitmishra786/low-level-dev-skills/assembly-x86"},{"id":"hypnguyen1209/offensive-claude/exploit-development"},{"id":"yaklang/hack-skills/kernel-exploitation"},{"id":"P4nda0s/reverse-skills/rev-unicorn-debug"},{"id":"hypnguyen1209/offensive-claude/shellcode-dev"}]},"slug":{"owner":"yaklang","repo":"hack-skills","skill":"stack-overflow-and-rop"},"version":"fe7c2746"}