0x7000 · Exploitation Techniques
SROP: Exploiting with a Fake Signal Frame
When gadgets are scarce, forge a signal frame. A sigreturn syscall restores every register from the stack at once — build one with pwntools to call execve, then see how seccomp and CET respond.