When the program has received a signal, It will be processing with switching to kernel-mode. Then, function does store user-mode's context on end of kernel stack space as temporary.

If the signal was processed successfully in the kernel, the kernel does restore of previously-stored context from stack to user-space context.

The Sigreturn-oriented programming(SROP) abuses that mechanism.

A signal is the fundamental concept of SROP and In this post, I will describe how the signal is processed at kernel-mode moreover demonstrate it.


When the process got a signal during runtime, The signal will be processed by default signal handler at the kernel-mode. For instance SIGINT(2), SIGKILL(9) , SIGSEGV(11) , etc.


The characteristics of the signal are as follows: