About this question
I have a program with a heap overflow. It contains some code that is not randomised (is not using ASLR). I want to do a return-oriented programming exploit. Since this is a heap overflow, the first thing I need to do is find a stack pivot, so I can get RSP pointing to a known memory address where my ROP program lives.
What are the state-of-the-art ways to find a stack pivot? What instruction sequences should I look for? Is there a list/database of instruction sequences that can be used as stack pivots? Also, are there any defences/mitigations I need to watch out for, or that it would help to be aware of?
