Free tools Windows power users keep installed
One-click scans. No signup required.
Return-oriented programming (ROP) is a code-reuse technique: after diverting a vulnerable program’s control flow, an attacker chains short instruction sequences already in the program’s address space to make it perform behavior. Because the instructions are already present, ROP does not require injecting new code. Preventing execution of newly written code alone therefore does not address every way a program’s existing code could be misused.
How can a program do something malicious without injected code?
Ordinary code injection adds instructions and attempts to execute them. ROP takes a different route: it uses instructions that are already in the target program’s address space. The attacker must first divert the program’s control flow—for example, by exploiting a vulnerability—but the subsequent computation can be assembled from existing code rather than a newly injected payload. The researchers who formalized the technique described it as inducing behavior in a program whose control flow has been diverted, “without injecting any code.” The 2012 journal paper sets out this general formulation.
As an Amazon Associate I earn from qualifying purchases.
This distinction matters for protections such as W⊕X, which aim to prevent memory from being both writable and executable. Such a protection can make executing newly written code harder, but it does not, on its own, prevent an attacker from redirecting execution through code that is already executable. That is why code-injection prevention and code-reuse prevention are related but distinct defensive problems. The ROP paper discusses the technique in relation to W⊕X.
What are ROP gadgets?
A gadget is a short sequence of machine instructions that already exists in a program’s address space. In classic ROP, each sequence ends in a return instruction. By arranging control flow so execution moves from one gadget to another, an attacker can combine small fragments into a larger computation. Shacham’s 2007 foundational paper demonstrated how short x86 instruction sequences could be used to construct gadgets capable of arbitrary computation. The paper’s account of return-into-libc without function calls describes that early work.
#1 Best Overall
Conceptually, the method resembles composing a task from fragments of instructions the program already contains. The crucial step is not creating new instructions, but steering execution among selected existing sequences. This is a description of the mechanism, not evidence that any particular program is exploitable: that depends on the program, its vulnerabilities, architecture, build, and defenses.
Does every code-reuse attack use a return instruction?
No. “Return-oriented programming” is commonly used for a family of code-reuse methods, but some related attacks avoid literal return instructions. A 2010 CCS paper demonstrated attacks on x86 and ARM using instruction sequences that behave like returns. The study of return-oriented programming without returns shows why a defense that only watches for frequent return instructions can miss variants.
The research demonstrations establish that these techniques have been studied on particular architectures and systems; they do not show that every processor, software build, or current deployment is equally susceptible. A result on one architecture should not be treated as a universal claim about all software.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhere did ROP come from?
Hovav Shacham’s “The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)” appeared at the ACM Conference on Computer and Communications Security in October 2007. It established the classic x86 gadget approach. A later paper by Ryan Roemer, Erik Buchanan, Hovav Shacham, and Stefan Savage developed the general formulation and discussed gadgets using the C library on Linux/x86 and Solaris/SPARC. The 2007 paper and the 2012 journal paper document these stages of the work.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What defenses help reduce ROP risk?
Control-flow integrity
Control-flow integrity (CFI) constrains which control transfers a program is allowed to make. A 2013 USENIX Security study reported that CFI could defeat most injected-code and existing-code attacks, including ROP, and described an implementation for stripped binaries on x86/Linux. That study is evidence for CFI as a mitigation family, not a guarantee that every CFI implementation, configuration, or environment stops every ROP variant.
Layered software and platform defenses
Secure coding and prompt patching help reduce the vulnerabilities that can let an attacker divert control flow. Platform protections can add further barriers, but their coverage varies by operating system, architecture, binary, and configuration. The cited CFI study is specific to its implementation and research setting; it does not establish a current platform-by-platform comparison or make any single mitigation a promise of immunity.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
