In return-oriented programming, what is the fundamental purpose of a 'gadget'?

A library function that can be called with arbitrary arguments

A sequence of instructions ending in a ret that performs a small, useful operation

A function that returns a pointer to the stack for use in shellcode

A hardware feature that prevents the stack from being executed

You are developing a ROP exploit for a 64-bit binary with NX and ASLR enabled. You have a stack overflow and a libc leak. You need to call execve("/bin/sh", NULL, NULL). You have found `pop rdi; ret`, `pop rsi; ret`, and `pop rdx; ret` gadgets. However, the binary crashes when you run the chain. What is the most likely cause?

The stack is not 16-byte aligned before calling execve.

The address of "/bin/sh" is incorrect because you used a stack address instead of a libc address.

The `pop rdx; ret` gadget is not present in the binary.

execve is not imported by the binary, so you must use a syscall gadget instead.

You are building a ROP chain and need to call a function that requires stack alignment to 16 bytes before the call. You have a `ret` gadget and a `pop rdi; ret` gadget. What should you do?

Add a dummy value after the `pop rdi; ret` gadget to pad the stack.

Ignore stack alignment; it is not required for most functions.

Use a `pop rdi; ret` gadget twice to consume an extra stack value.

Add an extra `ret` gadget before the function call to adjust the stack alignment.

You are analyzing a 32-bit binary with ROPgadget and need to call a function with two arguments. You have found `pop; pop; ret` and `pop; ret` gadgets. Which gadget should you use to set up the arguments for a cdecl function call?

Use `pop; ret` followed by a `ret` gadget to align the stack.

Use a `leave; ret` gadget to adjust the stack pointer before calling the function.

Use `pop; ret` twice in sequence, placing both arguments on the stack.

Use `pop; pop; ret` once, placing both arguments on the stack after the gadget address.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 3

Return Oriented Stack-Based Exploits GXPN Practice Questions (Page 3)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

Questions 11–15

11foundation · easy
In return-oriented programming, what is the fundamental purpose of a 'gadget'?
Select an answer first
12expert · hard
You are developing a ROP exploit for a 64-bit binary with NX and ASLR enabled. You have a stack overflow and a libc leak. You need to call execve("/bin/sh", NULL, NULL). You have found `pop rdi; ret`, `pop rsi; ret`, and `pop rdx; ret` gadgets. However, the binary crashes when you run the chain. What is the most likely cause?
Select an answer first
13application · medium
You are building a ROP chain and need to call a function that requires stack alignment to 16 bytes before the call. You have a `ret` gadget and a `pop rdi; ret` gadget. What should you do?
Select an answer first
14application · medium
You are analyzing a 32-bit binary with ROPgadget and need to call a function with two arguments. You have found `pop; pop; ret` and `pop; ret` gadgets. Which gadget should you use to set up the arguments for a cdecl function call?
Select an answer first
15application · easy
You are analyzing a binary with ROPgadget and need to find a gadget that can move a value from the stack into the rdx register. Which of the following gadget patterns would you search for?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Return Oriented Stack-Based Exploits GXPN Practice Questions (Page 3)

Questions 11–15

In return-oriented programming, what is the fundamental purpose of a 'gadget'?

You are building a ROP chain and need to call a function that requires stack alignment to 16 bytes before the call. You have a `ret` gadget and a `pop rdi; ret` gadget. What should you do?

You are analyzing a 32-bit binary with ROPgadget and need to call a function with two arguments. You have found `pop; pop; ret` and `pop; ret` gadgets. Which gadget should you use to set up the arguments for a cdecl function call?

You are analyzing a binary with ROPgadget and need to find a gadget that can move a value from the stack into the rdx register. Which of the following gadget patterns would you search for?

Keep studying — Exploitation Foundations and Memory Corruption