{"id":6542,"date":"2011-01-30T15:59:12","date_gmt":"2011-01-30T14:59:12","guid":{"rendered":"http:\/\/www.corelan.be:8800\/?p=6542"},"modified":"2011-01-30T15:59:12","modified_gmt":"2011-01-30T14:59:12","slug":"hack-notes-rop-retnoffset-and-impact-on-stack-setup","status":"publish","type":"post","link":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/","title":{"rendered":"Hack Notes : ROP retn+offset and impact on stack setup"},"content":{"rendered":"<p>Yesterday, <a href=\"http:\/\/sickness.tor.hu\/\">sickn3ss<\/a> (one of the frequent visitors of the #corelan channel on freenode IRC) posted a really interesting question.<\/p>\n<h3>The question<\/h3>\n<p>While testing <a href=\"\/index.php\/2010\/06\/16\/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube\/\">ROP<\/a> gadgets, as part of the process of building <a href=\"http:\/\/www.exploit-db.com\/exploits\/16072\">a DEP bypass exploit<\/a> for WM Downloader, he wanted to know if there is a way to predict the required padding needed to properly align\/set up the stack, when a gadget is used that ends with RET + offset.<\/p>\n<p>Apparently a lot of people assumed that the offset (offset to RET) needs be compensated immediately after the gadget pointer\u2026 but that's not true.<\/p>\n<p>Let's visualize the issue &amp; see if we can find a general rule.<\/p>\n<p>Let's say your ROP chain contains the following 3 (fake) gadgets :<\/p>\n<ul>\n<li>77C1E842 : PUSH EDI \/ POP EAX \/ POP EBP \/ RET <\/li>\n<li>77C1D7F5: ADD EAX,20 \/ POP EBP \/ RET <\/li>\n<li>71AA2526 : XOR EAX,EAX \/ INC ESI \/ RET <\/li>\n<li>\u2026 <\/li>\n<\/ul>\n<p>When setting up the stack with these pointers, the exploit developer has to compensate for any data that will be picked up (POP) or otherwise has to be put on the stack in order to make sure the RET (at the end of the gadget) will return to the next gadget pointer.<\/p>\n<p>The example setup (using the pointers above) would look like this :<\/p>\n<table border=\"1\" bordercolor=\"#000000\" width=\"681\" bgcolor=\"#ffffff\">\n<tbody>\n<tr>\n<td>ESP<\/td>\n<td>77C1E842<\/td>\n<td width=\"568\">&lt;- first gadget. PUSH EDI\/POP EAX is followed by POP EBP.<\/td>\n<\/tr>\n<tr>\n<td>ESP+4<\/td>\n<td>DAC0FF33<\/td>\n<td width=\"568\">&lt;- will be popped into EBP by gadget above. These 4 bytes need to be on the stack to make sure RET will land at next pointer (at ESP+8)<\/td>\n<\/tr>\n<tr>\n<td>ESP+8<\/td>\n<td>77C1D7F5<\/td>\n<td width=\"568\">&lt;- second gadget. POP EBP in this gadget will pick up the next 4 bytes on the stack<\/td>\n<\/tr>\n<tr>\n<td>ESP+C<\/td>\n<td>DAC0FF33<\/td>\n<td width=\"568\">&lt;- will be popped into EBP by gadget 77C1D7F5. RET will then land at next pointer (at ESP+10)<\/td>\n<\/tr>\n<tr>\n<td>ESP+10<\/td>\n<td>71AA2526<\/td>\n<td width=\"568\">&lt;- third gadget. No additional bytes are needed because nothing will be picked up from stack by this gadget<\/td>\n<\/tr>\n<tr>\n<td>ESP+14<\/td>\n<td>&#160;<\/td>\n<td width=\"568\">&lt;- 4th gadget needs to be put here<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Nothing really special here.<\/p>\n<p>What happens if the gadgets end with RET + offset ? How does that impact the stack alignment \/ padding bytes you need to put in between 2 gadget pointers ?<\/p>\n<h3>The answer<\/h3>\n<p>Let's say we have the following gadgets :<\/p>\n<ul>\n<li>77C1E842 : PUSH EDI \/ POP EAX \/ POP EBP \/ RETN + 4 <\/li>\n<li>77C1D7F5: ADD EAX,20 \/ POP EBP \/ RETN + 8 <\/li>\n<li>71AA2526 : XOR EAX,EAX \/ INC ESI \/ RET <\/li>\n<li>\u2026 <\/li>\n<\/ul>\n<p>The first gadget ends with RETN+4. The second gadget ends with RETN+8.&#160; How does this impact the stack layout ?<\/p>\n<table border=\"1\" bordercolor=\"#000000\" width=\"684\" bgcolor=\"#ffffff\">\n<tbody>\n<tr>\n<td>ESP<\/td>\n<td>77C1E842<\/td>\n<td width=\"449\">&lt;- first gadget. PUSH EDI\/POP EAX is followed by POP EBP and RETN + 4<\/td>\n<\/tr>\n<tr>\n<td>ESP+4<\/td>\n<td>DAC0FF33<\/td>\n<td width=\"449\">&lt;- will be popped into EBP by gadget above. These 4 bytes need to be on the stack to make sure RET will land at next pointer (at ESP+8)<\/td>\n<\/tr>\n<tr>\n<td>ESP+8<\/td>\n<td>77C1D7F5<\/td>\n<td width=\"449\">&lt;- second gadget. POP EBP will pick up next 4 bytes. This gadget ends with RETN + 8<\/td>\n<\/tr>\n<tr>\n<td>ESP+C<\/td>\n<td><strong><span style=\"color: #ffff00\">41414141<\/span><\/strong><\/td>\n<td width=\"449\">&lt;- these are the 4 bytes needed to compensate for RET+4 in the first gadget. As you can see, the 4 bytes compensation need to be placed after the next RET instruction (so after the next gadget).<\/td>\n<\/tr>\n<tr>\n<td>ESP+10<\/td>\n<td>DAC0FF33<\/td>\n<td width=\"449\">&lt;- will be popped into EBP by gadget 77C1D7F5. RET will then land at next pointer (at ESP+10)<\/td>\n<\/tr>\n<tr>\n<td>ESP+14<\/td>\n<td>71AA2526<\/td>\n<td width=\"449\">&lt;- third gadget. No additional bytes are needed because nothing will be picked up from stack by this gadget.<\/td>\n<\/tr>\n<tr>\n<td>ESP+18<\/td>\n<td><strong><span style=\"color: #ffff00\">41414141<\/span><\/strong><\/td>\n<td width=\"449\">4 bytes of padding - compensate for the first 4 bytes in RET+8 (gadget 2)<\/td>\n<\/tr>\n<tr>\n<td>ESP+1C<\/td>\n<td><strong><span style=\"color: #ffff00\">41414141<\/span><\/strong><\/td>\n<td width=\"449\">4 bytes of padding - compensate for the second 4 bytes in RET + 8&#160; (gadget 2)<\/td>\n<\/tr>\n<tr>\n<td>ESP+20<\/td>\n<td>&nbsp;<\/td>\n<td width=\"449\">&lt;- 4th gadget must be placed here<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Conclusion : the offset to RET must be accounted for on the stack after the next gadget pointer, and not after the current gadget pointer.<\/p>\n<p>Thanks <a href=\"https:\/\/twitter.com\/sickness416\">sickn3ss<\/a> for popping the question &amp; working with me to documenting the behaviour !<\/p>\n<hr \/>\n<p>&#160;<\/p>\n<p><!--Digiprove_Start--><span lang=\"en\" xml:lang=\"en\" class=\"notranslate\" style=\"vertical-align:middle; display:inline; padding:3px; line-height:normal;border:1px solid #e3e3e3;background-color:#000000;\" title=\"certified 12 February 2011 15:04:02 UTC by Digiprove certificate P101459\" ><a href=\"http:\/\/www.digiprove.com\/show_certificate.aspx?id=P101459%26guid=lRUgZm6MTkOmBg5G_VXpmA\" target=\"_blank\" rel=\"copyright noopener\" style=\"border:0px; float:none; display:inline; text-decoration: none; background-color:transparent\"><img decoding=\"async\" src=\"http:\/\/www.corelan.be\/wp-content\/plugins\/digiproveblog\/dp_seal_trans_16x16.png\" style=\"vertical-align:middle; display:inline; border:0px; margin:0px; float:none; background-color:transparent\" border=\"0\" alt=\"\"\/><span style=\"font-family: Tahoma, MS Sans Serif; font-size:11px; font-weight:normal; color:#FFFFFF; border:0px; float:none; display:inline; text-decoration:none; letter-spacing:normal\" onmouseover=\"this.style.color='#FFFF1C';\" onmouseout=\"this.style.color='#FFFFFF';\">&nbsp;&nbsp;Copyright secured by Digiprove&nbsp;&copy; 2011 Peter Van Eeckhoutte<\/span><\/a><!--BEB149DBBAF82BA54624052CDFB1738D5AC8B1EBA2EEBA33719AD27A36BA5C42--><\/span><!--Digiprove_End--><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Yesterday, sickn3ss (one of the frequent visitors of the #corelan channel on freenode IRC) posted a really interesting question. The question While testing ROP gadgets, as part of the process of building a DEP bypass exploit for WM Downloader, he wanted to know if there is a way to predict the required padding needed to &hellip; <a href=\"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> \"Hack Notes : ROP retn+offset and impact on stack setup\"<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[244,245,127],"tags":[3733,2802,2339,2331,1836],"class_list":["post-6542","post","type-post","status-publish","format-standard","hentry","category-exploit-writing-tutorials","category-exploits","category-security","tag-exploit-development-tutorial","tag-mona-py","tag-rop","tag-gadget","tag-stack"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Hack Notes : ROP retn+offset and impact on stack setup - Corelan | Exploit Development &amp; Vulnerability Research<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hack Notes : ROP retn+offset and impact on stack setup - Corelan | Exploit Development &amp; Vulnerability Research\" \/>\n<meta property=\"og:description\" content=\"Yesterday, sickn3ss (one of the frequent visitors of the #corelan channel on freenode IRC) posted a really interesting question. The question While testing ROP gadgets, as part of the process of building a DEP bypass exploit for WM Downloader, he wanted to know if there is a way to predict the required padding needed to &hellip; Continue reading &quot;Hack Notes : ROP retn+offset and impact on stack setup&quot;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/\" \/>\n<meta property=\"og:site_name\" content=\"Corelan | Exploit Development &amp; Vulnerability Research\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/corelanconsulting\" \/>\n<meta property=\"article:published_time\" content=\"2011-01-30T14:59:12+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/www.corelan.be\/wp-content\/plugins\/digiproveblog\/dp_seal_trans_16x16.png\" \/>\n<meta name=\"author\" content=\"corelanc0d3r\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@corelanc0d3r\" \/>\n<meta name=\"twitter:site\" content=\"@corelanc0d3r\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2011\\\/01\\\/30\\\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2011\\\/01\\\/30\\\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\\\/\"},\"author\":{\"name\":\"corelanc0d3r\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/person\\\/3be5542b9b0a0787893db83a5ad68e8f\"},\"headline\":\"Hack Notes : ROP retn+offset and impact on stack setup\",\"datePublished\":\"2011-01-30T14:59:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2011\\\/01\\\/30\\\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\\\/\"},\"wordCount\":666,\"publisher\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2011\\\/01\\\/30\\\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\\\/#primaryimage\"},\"thumbnailUrl\":\"http:\\\/\\\/www.corelan.be\\\/wp-content\\\/plugins\\\/digiproveblog\\\/dp_seal_trans_16x16.png\",\"keywords\":[\"exploit development tutorial\",\"mona.py\",\"rop\",\"gadget\",\"stack\"],\"articleSection\":[\"Exploit Writing Tutorials\",\"Exploits\",\"Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2011\\\/01\\\/30\\\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\\\/\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2011\\\/01\\\/30\\\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\\\/\",\"name\":\"Hack Notes : ROP retn+offset and impact on stack setup - Corelan | Exploit Development &amp; Vulnerability Research\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2011\\\/01\\\/30\\\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2011\\\/01\\\/30\\\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\\\/#primaryimage\"},\"thumbnailUrl\":\"http:\\\/\\\/www.corelan.be\\\/wp-content\\\/plugins\\\/digiproveblog\\\/dp_seal_trans_16x16.png\",\"datePublished\":\"2011-01-30T14:59:12+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2011\\\/01\\\/30\\\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2011\\\/01\\\/30\\\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2011\\\/01\\\/30\\\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\\\/#primaryimage\",\"url\":\"http:\\\/\\\/www.corelan.be\\\/wp-content\\\/plugins\\\/digiproveblog\\\/dp_seal_trans_16x16.png\",\"contentUrl\":\"http:\\\/\\\/www.corelan.be\\\/wp-content\\\/plugins\\\/digiproveblog\\\/dp_seal_trans_16x16.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2011\\\/01\\\/30\\\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.corelan.be\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hack Notes : ROP retn+offset and impact on stack setup\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#website\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/\",\"name\":\"Corelan CyberSecurity Research\",\"description\":\"Corelan publishes in-depth tutorials on exploit development, Windows exploitation, vulnerability research, heap internals, reverse engineering and security tooling used by professionals worldwide.\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.corelan.be\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\",\"name\":\"Corelan CyberSecurity Research\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/corelanlogo2_small-20.png\",\"contentUrl\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/corelanlogo2_small-20.png\",\"width\":200,\"height\":200,\"caption\":\"Corelan CyberSecurity Research\"},\"image\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/corelanconsulting\",\"https:\\\/\\\/x.com\\\/corelanc0d3r\",\"https:\\\/\\\/x.com\\\/corelanconsulting\",\"https:\\\/\\\/instagram.com\\\/corelanconsult\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/person\\\/3be5542b9b0a0787893db83a5ad68e8f\",\"name\":\"corelanc0d3r\",\"pronouns\":\"he\\\/him\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x\",\"caption\":\"corelanc0d3r\"},\"description\":\"Peter Van Eeckhoutte is the founder of Corelan and a globally recognized expert in exploit development and vulnerability research. With over two decades in IT security, he built Corelan into a respected platform for deep technical research, hands-on training, and knowledge sharing. Known for his influential exploit development tutorials, tools, and real-world training, Peter combines a strong research mindset with a passion for education\u2014helping security professionals understand not just how exploits work, but why.\",\"sameAs\":[\"https:\\\/\\\/www.corelan-training.com\",\"https:\\\/\\\/instagram.com\\\/corelanc0d3r\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/petervaneeckhoutte\\\/\",\"https:\\\/\\\/x.com\\\/corelanc0d3r\"],\"url\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/author\\\/admin0\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hack Notes : ROP retn+offset and impact on stack setup - Corelan | Exploit Development &amp; Vulnerability Research","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/","og_locale":"en_US","og_type":"article","og_title":"Hack Notes : ROP retn+offset and impact on stack setup - Corelan | Exploit Development &amp; Vulnerability Research","og_description":"Yesterday, sickn3ss (one of the frequent visitors of the #corelan channel on freenode IRC) posted a really interesting question. The question While testing ROP gadgets, as part of the process of building a DEP bypass exploit for WM Downloader, he wanted to know if there is a way to predict the required padding needed to &hellip; Continue reading \"Hack Notes : ROP retn+offset and impact on stack setup\"","og_url":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/","og_site_name":"Corelan | Exploit Development &amp; Vulnerability Research","article_publisher":"https:\/\/www.facebook.com\/corelanconsulting","article_published_time":"2011-01-30T14:59:12+00:00","og_image":[{"url":"http:\/\/www.corelan.be\/wp-content\/plugins\/digiproveblog\/dp_seal_trans_16x16.png","type":"","width":"","height":""}],"author":"corelanc0d3r","twitter_card":"summary_large_image","twitter_creator":"@corelanc0d3r","twitter_site":"@corelanc0d3r","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/#article","isPartOf":{"@id":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/"},"author":{"name":"corelanc0d3r","@id":"https:\/\/www.corelan.be\/#\/schema\/person\/3be5542b9b0a0787893db83a5ad68e8f"},"headline":"Hack Notes : ROP retn+offset and impact on stack setup","datePublished":"2011-01-30T14:59:12+00:00","mainEntityOfPage":{"@id":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/"},"wordCount":666,"publisher":{"@id":"https:\/\/www.corelan.be\/#organization"},"image":{"@id":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/#primaryimage"},"thumbnailUrl":"http:\/\/www.corelan.be\/wp-content\/plugins\/digiproveblog\/dp_seal_trans_16x16.png","keywords":["exploit development tutorial","mona.py","rop","gadget","stack"],"articleSection":["Exploit Writing Tutorials","Exploits","Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/","url":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/","name":"Hack Notes : ROP retn+offset and impact on stack setup - Corelan | Exploit Development &amp; Vulnerability Research","isPartOf":{"@id":"https:\/\/www.corelan.be\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/#primaryimage"},"image":{"@id":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/#primaryimage"},"thumbnailUrl":"http:\/\/www.corelan.be\/wp-content\/plugins\/digiproveblog\/dp_seal_trans_16x16.png","datePublished":"2011-01-30T14:59:12+00:00","breadcrumb":{"@id":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/#primaryimage","url":"http:\/\/www.corelan.be\/wp-content\/plugins\/digiproveblog\/dp_seal_trans_16x16.png","contentUrl":"http:\/\/www.corelan.be\/wp-content\/plugins\/digiproveblog\/dp_seal_trans_16x16.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.corelan.be\/index.php\/2011\/01\/30\/hack-notes-rop-retnoffset-and-impact-on-stack-setup\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.corelan.be\/"},{"@type":"ListItem","position":2,"name":"Hack Notes : ROP retn+offset and impact on stack setup"}]},{"@type":"WebSite","@id":"https:\/\/www.corelan.be\/#website","url":"https:\/\/www.corelan.be\/","name":"Corelan CyberSecurity Research","description":"Corelan publishes in-depth tutorials on exploit development, Windows exploitation, vulnerability research, heap internals, reverse engineering and security tooling used by professionals worldwide.","publisher":{"@id":"https:\/\/www.corelan.be\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.corelan.be\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.corelan.be\/#organization","name":"Corelan CyberSecurity Research","url":"https:\/\/www.corelan.be\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.corelan.be\/#\/schema\/logo\/image\/","url":"https:\/\/www.corelan.be\/wp-content\/uploads\/2026\/03\/corelanlogo2_small-20.png","contentUrl":"https:\/\/www.corelan.be\/wp-content\/uploads\/2026\/03\/corelanlogo2_small-20.png","width":200,"height":200,"caption":"Corelan CyberSecurity Research"},"image":{"@id":"https:\/\/www.corelan.be\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/corelanconsulting","https:\/\/x.com\/corelanc0d3r","https:\/\/x.com\/corelanconsulting","https:\/\/instagram.com\/corelanconsult"]},{"@type":"Person","@id":"https:\/\/www.corelan.be\/#\/schema\/person\/3be5542b9b0a0787893db83a5ad68e8f","name":"corelanc0d3r","pronouns":"he\/him","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x","url":"https:\/\/secure.gravatar.com\/avatar\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x","caption":"corelanc0d3r"},"description":"Peter Van Eeckhoutte is the founder of Corelan and a globally recognized expert in exploit development and vulnerability research. With over two decades in IT security, he built Corelan into a respected platform for deep technical research, hands-on training, and knowledge sharing. Known for his influential exploit development tutorials, tools, and real-world training, Peter combines a strong research mindset with a passion for education\u2014helping security professionals understand not just how exploits work, but why.","sameAs":["https:\/\/www.corelan-training.com","https:\/\/instagram.com\/corelanc0d3r","https:\/\/www.linkedin.com\/in\/petervaneeckhoutte\/","https:\/\/x.com\/corelanc0d3r"],"url":"https:\/\/www.corelan.be\/index.php\/author\/admin0\/"}]}},"views":15331,"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts\/6542","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/comments?post=6542"}],"version-history":[{"count":0,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts\/6542\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/media?parent=6542"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/categories?post=6542"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/tags?post=6542"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}