Return-oriented programming and calling conventions

Mechanism

ROP composes existing instruction sequences ending in control transfers. A chain must supply arguments according to the target ABI, maintain stack alignment, and preserve required state between gadgets. A list of gadget addresses is not a working chain until each transition and side effect is accounted for.

Practical method

Identify the target function, its calling convention, and the available argument-setting gadgets. Annotate every stack word with the instruction that consumes it. Step through a short chain in a debugger and inspect registers before the function call. Establish the loaded image bases independently of gadget selection.

stack: [pop argument gadget][argument][target function][continuation]
check: register destination, extra pops, clobbers, alignment

Interpreting evidence

The most useful checkpoint is entry to the target function with correct arguments and aligned stack. A crash inside a vector instruction may indicate alignment rather than an invalid function address.

Pitfalls and limits

Gadgets frequently pop extra registers or adjust the stack. x86-64 System V and Windows x64 use different argument registers and stack rules. Position-independent addresses require a valid runtime base.