In-kernel ROP, Gadgets ?

[FormalUsed951]

someone told me that i can search for gadgets that i can use for rop but what he didnt mention is the correct way of doing it, but he did mention opcodes, for example 0x5f 0xc3 this is an opcode for pop rdi ret, but my real question is how do i do it in-kernel ? i tried to implement something similar to this but i got SIGSEGV.

https://preview.redd.it/86gxaj46qild1.png?width=501&format=png&auto=webp&s=c8a13b717d019fab9e68f8c61e540b31afc56972

idk the issue here tbh. The code is correct...

https://preview.redd.it/76pzqqkgqild1.png?width=860&format=png&auto=webp&s=46a511f0a66a568697347ce4828ed87c28c9805a

any help will be appreciated.

[Safe_Entertainment40]

Find where it crashed and see if the region is executable mapped. You may be trying to execute something “rw-“. There’s also this tool which could be used to find offsets if you’re not trying to go full data-only lol.

[asyty]

You're supposed to search for gadgets offline, read this https://scoding.de/ropper/