Skip to main content

05. ret2csu Mini Cheatsheet

When ROP gadgets are scarce in a PIE/NX environment, you can build a function call with two gadgets from __libc_csu_init. The key is to complete rdi/rsi/rdx setup and the function-pointer call in one sequence.

Gadget layout​

  • Gadget 1: pop rbx; pop rbp; pop r12; pop r13; pop r14; pop r15; ret
  • Gadget 2: mov rdx, r14; mov rsi, r13; mov edi, r12d; call [r15+rbx*8]

Flow​

  1. Use Gadget 1 to set r12=arg1, r13=arg2, r14=arg3, and r15=function-pointer table
  2. Set rbx=0 and rbp=1, then execute Gadget 2
  3. Complete one call to the desired function

Tips​

  • Putting a PLT entry in r15 makes the call easier
  • Keep rbp=1 to avoid the loop that increments rbx
  • Place the return address for stack cleanup after Gadget 2 in advance