Pre-built JOP Chains with the JOP ROCKET: Bypassing DEP without ROP

on YouTube ↗37m

" summary

Tool claims to build pre-built JOP chains that bypass DEP without ROP by statically finding dispatcher gadgets, dispatch tables and functional gadgets from binaries (30k‑line Python using Capstone/pefile). It auto-calculates stack pivots, produces chains per register, and targets WinAPI calls (VirtualProtect/VirtualAlloc) while handling bad bytes via XOR or the move-dereference method and a push method. Demo shows a buffer‑overflow exploit working with an 894‑byte pivot; requirements: a dispatcher gadget and enough gadgets, with CFG/ASLR workarounds available.

AI-written summary · about

" chapters (10)

1. 0:00Intro
2. 1:30Agenda
3. 3:04Job Control Flow
4. 5:03Job Control Flow Diagram
5. 7:00Job Rocket Overview
6. 10:20Job Rocket Interface
7. 12:08Manual Approach
8. 21:26Automated Generation
9. 27:43BadBytes
10. 30:11Austin

" related talks

• 35mCommSec D2 - Automatic Generation of ROP ChainsRicardo. J. Rodríguez, Daniel Uroz · Hack In The Box Amsterdam 2018
• 57mReturn Oriented Programming, an introductionPatricia Aas · NDC TechTown 2023
• 50mWrite Once, Pwn AnywhereYang Yu · Black Hat USA 2014
• 57mReturn Oriented Programming, an introductionPatricia Aas · NDC Security 2023
• 27mWhat Cannot Be Read, Cannot Be Leveraged? Revisiting Assumptions of JIT-ROP...Christian Rossow, Michael Backes, Giorgi Maisuradze · USENIX Security '16
• 33mHacking in Darkness: Return-oriented Programming against Secure EnclavesYeongjin Jang, Taesoo Kim, Jaehyuk Lee, Jinsoo Jang, Nohyun Kwak, Yeseul Choi, Changho Choi, Marcus Peinado, Brent Byunghoon Kang · 26th USENIX Security Symposium (USENIX Security '17)
• 58mExploiting Adobe Flash Player In The Era Of Control Flow GuardFrancisco Falcon · Black Hat Europe 2015
• 29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single PacketDor Zusman, Barak Hadad · Black Hat Asia 2020