## https://sploitus.com/exploit?id=DBD8954D-C529-56DD-AF92-92490F34C430
# Rop Emporium challenges
Link: https://ropemporium.com/
### Challenge 0: ret2win ([64 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/0_ret2win) and [32 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/0_ret2win32))
ret2win means 'return here to win' and it's recommended you start with this challenge. Visit the challenge page by clicking the link above to learn more.
### Challenge 1: split ([64 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/1_split) and [32 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/1_split32))
Combine elements from the ret2win challenge that have been split apart to beat this challenge. Learn how to use another tool whilst crafting a short ROP chain.
### Challenge 2: callme ([64 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/2_callme) and [32 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/2_callme32))
Chain calls to multiple imported methods with specific arguments and see how the differences between 64 & 64 bit calling conventions affect your ROP chain.
### Challenge 3: write4 ([64 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/3_write4) and [32 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/3_write432))
Find and manipulate gadgets to construct an arbitrary write primitive and use it to learn where and how to get your data into process memory.
### Challenge 4: badchars ([64 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/4_badchars) and [32 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/4_badchars32))
Learn to deal with badchars, characters that will not make it into process memory intact or cause other issues such as premature chain termination.
### Challenge 5: fluff ([64 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/5_fluff) and [32 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/5_fluff32))
Sort the useful gadgets from the fluff to construct another write primitive in this challenge. You'll have to get creative though, the gadgets aren't straight forward.
### Challenge 6: pivot ([64 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/6_pivot) and [32 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/6_pivot32))
Stack space is at a premium in this challenge and you'll have to pivot the stack onto a second ROP chain elsewhere in memory to ensure your success.
### Challenge 7: ret2csu ([64 bits](https://github.com/ricardojoserf/rop-emporium-exploits/tree/master/7_ret2csu))
Learn a ROP technique that lets you populate useful 64 bit calling convention registers like rdi, rsi and rdx even in an environment where gadgets are sparse.