Skip to main content

04. A Quick Feel for SROP: Setting Every Register with sigreturn

SROP (Sigreturn Oriented Programming) calls sys_rt_sigreturn to make the kernel restore the sigcontext on the stack verbatim. It can shorten a ROP chain or set all registers at once when gadgets are scarce. The key is to place a fake signal frame on the stack and trigger rt_sigreturn with syscall; ret.

Flow​

  • Control RIP through a vulnerability
  • Fill a sigcontext structure on the stack, including RSP, RIP, RDI/RSI/RDX, and others
  • Set rax=15 (rt_sigreturn), then execute syscall
  • The kernel restores the registers → jumps to the desired code

CTF Tips​

  • Create the frame with pwntools.SigreturnFrame()
  • Use read(0, rsp, size) to overwrite the frame further
  • In a PIE/ASLR environment, chain leak → SROP

It is easy to remember SROP as “a special ROP that sets up all registers at once.” It is especially powerful in binaries with few gadgets.