Skip to main content

25. ret2dlresolve: A ROP Trick That Turns the Symbol Resolver Against Itself

ret2dlresolve abuses the dynamic linker's (ld.so) symbol-resolution process to call through ROP even functions that are absent from the binary. It is especially powerful in CTF binaries with limited PLT/GOT entries.

Core Idea​

  • Call read through ROP to plant fake Elf64_Rela, Elf64_Sym, and string tables in memory
  • Jump to plt[0] (the resolver stub) to forcibly execute the symbol-resolution routine
  • The desired function, such as system or execve, is called as the resolution result

Attack Flow Summary​

  • Construct the payload structures in BSS/on the stack
  • Set rdi/rsi/rdx → inject the structures with read
  • Manipulate plt[0] + the index to invoke the resolver

Defensive Points​

  • FULL RELRO, PIE, and NX remain valid defensive layers
  • ASLR + PIE in particular greatly increases attack difficulty

If “there is no system in the PLT” in a CTF, consider ret2dlresolve.