“绵县 Introduction The building blocks for the traditional return-into-libc attack are functions and these can be removed by the maintainers of libc. By contrast,the building blocks for ROP are short code sequences,each just two or three instructions long,end in a return instruction(gadgets).Some are present in libc as a result of the code-generation choices of the compiler.Others are found in libc despite not having been placed there at all by the compiler.In either case,these code sequences would be very difficulty to eliminate without extensive modifications to the compiler and assembler. 2023/2/7 52023/2/7 5 Introduction ◼ The building blocks for the traditional return-into-libc attack are functions and these can be removed by the maintainers of libc. ◼ By contrast, the building blocks for ROP are short code sequences, each just two or three instructions long, end in a return instruction(gadgets). Some are present in libc as a result of the code-generation choices of the compiler. Others are found in libc despite not having been placed there at all by the compiler. In either case, these code sequences would be very difficulty to eliminate without extensive modifications to the compiler and assembler