Metasploit provides a very convenient tool to find ROP gadgets: msfrop. It not only enables us to list all the ROP gadgets but also allows us to search through those gadgets to find the appropriate gadgets for our required actions. Let's say we need to see all the gadgets that can help us to perform a pop operation over the ECX register. We can do this using msfrop, as follows:
As soon as we provide the -s switch for searching and -v for verbose output, we start getting a list of all the gadgets where the POP ECX instruction is used. Let's see the results:
We can see that we have various gadgets that can perform ...
