- Published on
Adding RDX to the chain completed my first three-register ROP setup and reinforced how the AMD64 calling convention shapes payloads.
Ret2win
All Posts
- pwn (12)
- ctf (11)
- pcc25-qual (10)
- pwn-learning-path (10)
- rop (8)
ret2win (5)
- reverse-engineering (4)
- tutorial (3)
- xor (3)
- binary-exploitation (3)
- buffer-overflow (3)
- gdb (3)
- calling-convention (3)
- cryptography (2)
- misc (2)
- binary-analysis (2)
- pwntools (2)
- stack-alignment (2)
- cpp (1)
- programming (1)
- coding (1)
- software-development (1)
- docker (1)
- cybersecurity (1)
- capture-the-flag (1)
- blogging (1)
- getting-started (1)
- vm (1)
- custom-architecture (1)
- forensics (1)
- bash-history (1)
- bash (1)
- parameter-expansion (1)
- wildcards (1)
- python (1)
- injection (1)
- exec (1)
- code-injection (1)
- memory-corruption (1)
- java (1)
- spring-boot (1)
- classfinal (1)
- aes (1)
- static-analysis (1)
- web (1)
- lfi (1)
- php (1)
- filter-chains (1)
- roadmap (1)
- x86-64 (1)
- stack (1)
- sse (1)
- ret2libc (1)
- got-plt (1)
- Published on
Extending ret2win to control both RDI and RSI, and learning to read a ROP payload as a sequence of state changes.- Published on
Moving from saved RIP control to a small ROP chain that loads 0xdeadbeef into RDI before calling win.- Published on
A 64-byte buffer, an oversized read, and 72 bytes to saved RIP: how my first ret2win payload redirected control flow.- Published on
ROP challenge demonstrating ret2win technique. Used ROP gadgets to call win function with correct arguments and gain shell access.