# Lab06: rop

Return-oriented programming (ROP) is, in essence, same as ret-to-lib(c)
that we've learned last week. However, in this lab, all binaries are somewhat
more complicated. Have fun!

* Problems

  + [level 00] tut06-rop            [20 points]
  + [level 01] tut06-advrop         [20 points]
  + [level 02] rop-64               [20 points]
  + [level 03] pop                  [20 points]
  + [level 04] puzzle               [20 points]
  + [level 05] upto-retaddr         [20 points]
  + [level 06] find-gadget          [20 points]
  + [level 07] sprintf              [20 points]
  + [level 08] rop-sorting          [20 points]
  + [level 09] inc1                 [20 points]
  + [level 10] fmtstr-relro         [20 points]
  + [level 11] riscy                [20 points]

* Refs
  - https://hovav.net/ucsd/dist/blackhat08.pdf
  - http://blog.exploitlab.net/2013/06/dive-into-rop-blackhat-usa-2013.html
  - https://cseweb.ucsd.edu/~hovav/dist/rop.pdf