Returnoriented

Return-oriented programming (ROP) is an exploitation technique that enables arbitrary code execution by reusing existing code sequences within a program, rather than injecting new code. These sequences, known as gadgets, are short fragments of instructions that end with a return instruction. By corrupting a program’s control flow and carefully arranging a chain of gadget addresses on the stack, an attacker can execute a desired sequence of operations, effectively composing a payload from the program’s own code.

ROP relies on the presence of executable memory containing useful instruction sequences, often in the program itself or in linked libraries. Since the attacker does not need to inject code, ROP can bypass defenses that prevent code from being created at runtime, such as data execution prevention (DEP) or NX-bit protections. The technique is particularly associated with return instructions, but variations exist that use other control-flow transfers like jumps or calls.

The typical objective of a ROP chain is to achieve controlled, stepwise actions such as setting up registers, invoking system calls, or calling existing legitimate functions in a controlled order. Building a reliable chain requires knowledge of the target’s memory layout and calling conventions, and it must contend with factors such as gadget availability, alignment, and opportunities for misalignment or crashes.

History and variants: ROP was formally described by Hovav Shacham in 2007 as a method to bypass non-executable stacks. Related concepts include jump-oriented programming (JOP), which uses gadgets ending in indirect jumps, and call-oriented programming (COP), which uses call instructions and returns for control flow.

Defenses: Mitigations combine hardware and software approaches, including DEP/NX, address space layout randomization (ASLR), control-flow integrity (CFI), shadow stacks, and code randomization. Comprehensive mitigations often require a defense-in-depth strategy to reduce gadget availability and disrupt gadget chaining.