ROP Development

Goal: produce reliable, reproducible chains — not one-shot lucky payloads. Build from ABI facts, memory disclosures, and deterministic gadget policies.

When to activate

• You need a chain for ret2libc, ret2syscall, ret2csu, SROP, or Windows API-call ROP (VirtualProtect, NtProtectVirtualMemory)
• Exploit crashes exist but NX/DEP + ASLR/PIE prevent direct shellcode
• Gadget discovery returns too many noisy candidates and chain stability is poor
• A working chain breaks across OS versions or minor binary rebuilds
• You must reason about CET/Shadow Stack / CFG feasibility before investing in ROP

Core operating model