Advanced ROP Framework: Pushing ROP to Its Limits
Dr. Bramwell Brizendine and Davy Kusuma present ROP ROCKET, an automated ROP compiler supporting Heaven's Gate architecture switching and bad-byte gadget synthesis.
Summary
Challenges in Modern Return-Oriented Programming
Constructing reliable ROP chains to bypass Data Execution Prevention (DEP) often fails due to bad character filters in target memory and limited gadget availability.
Introducing the ROP ROCKET Framework
Dr. Bramwell Brizendine and Davy Kusuma unveil ROP ROCKET, an automated ROP chain synthesis framework featuring novel code reuse and gadget transformation primitives.
Heaven's Gate Architecture Switching in ROP
ROCKET invokes specialized ROP Heaven's Gate gadgets to dynamically transition 32-bit processes into 64-bit execution mode at runtime, dramatically expanding available gadget space.
Automated Syscall Invocations and Bad-Byte Gadget Obfuscation
Using direct Windows syscalls rather than Win32 APIs enables automatic DEP bypasses, while algebraic gadget synthesis allows utilizing gadgets whose addresses contain forbidden bytes.
Related talks
Main Stage·36 min
Hadrian Barral
Introduces modern shellcoding techniques that survive ASLR, NX, and common AV detection by combining gadget chaining with runtime resolution.
Main Stage·22 min
Bramwell Brizendine
Introduces JOP ROCKET, an open-source tool for discovering Jump-Oriented Programming gadgets to build control-flow hijacking exploits.
Main Stage·43 min
Daniel Selifonov
Daniel Selifonov explores advanced memory corruption exploitation primitives, demonstrating deterministic heap layout manipulation and mitigation bypasses.