SROP: forging a sigreturn

When a signal handler returns, the kernel calls sigreturn, which restores the entire CPU context from a structure (sigcontext) on the stack. That structure, if you control it, defines every register.

The idea

Sigreturn-Oriented Programming: build a fake sigcontext on the stack with the registers you want (including rip), then invoke sigreturn (syscall 15). The kernel loads your values. You just need a syscall; ret gadget and to know where /bin/sh is.

frame.rax = 59  # execve
frame.rdi = "/bin/sh"
frame.rip = syscall_gadget

Why it is powerful

With very few gadgets (often only syscall) you set all registers: useful on minimal binaries lacking classic gadgets. pwntools has SigreturnFrame().

Defence

Seccomp to restrict syscalls (block execve), CET/shadow stack, and the usual ASLR/RELRO. Reducing exposed syscall gadgets helps but does not remove the vector.