Chapter 11: Bypassing Protections with ROP

1. Software-based and hardware-based.
2. libc is the C standard library.
3. As long as you'd like; you can define 5 or 100 bytes with the --depth flag in MSFrop and ROPgadget.
4. ASLR.
5. The PLT converts function calls to absolute destination addresses; the GOT converts address calculations to absolute destinations.
6. Open gdb [binary] and disassemble main() with disas, then look for the system@plt call.
7. The > operator packs the binary data as big-endian; x86 processors are little-endian.