Return-Oriented Programming
Return-Oriented Programming (ROP) · Also known as: ROP, code reuse attack, Turing-complete gadget
Return-Oriented Programming (ROP) is an exploit technique that chains together short sequences of instructions (gadgets) from existing executable code to perform arbitrary computation, bypassing security defenses like code injection prevention. Introduced by Hovav Shacham in 2007, ROP exploits code reuse to execute malicious logic even when data execution prevention (DEP) and code signing prevent direct code injection. ROP is considered one of the most powerful exploit techniques against modern defense mechanisms and has been demonstrated to be Turing-complete.
Read the full method
Sign in with a free account to read this section.
Method map
The neighbourhood of related methods — select a node to explore.
When to use it
ROP is an offensive technique used by attackers to bypass code injection defenses. Defenders study ROP to understand exploit techniques and develop mitigations. ROP is particularly relevant when data execution prevention prevents direct code injection.
Strengths & limitations
- Bypasses data execution prevention (DEP/NX bit) by reusing existing executable code
- Powerful and flexible; ROP chains can implement arbitrary computation (Turing-complete)
- Code gadgets are available in legitimate binaries and libraries, making gadget discovery feasible
- Demonstrates that code injection defenses alone are insufficient for security
- Requires a vulnerability to gain initial memory corruption capability
- Gadget discovery and chain construction are computationally expensive; tools help automate the process
- Code layout randomization (ASLR) and gadget deduplication (code diversity) significantly complicate ROP attacks
- Chain construction is complex for arbitrary computation; simpler chains are more practical
Frequently asked
Is ROP Turing-complete?
Yes. Theoretically, ROP chains can implement any computable function if sufficient gadgets are available. In practice, constructing complex computations is challenging but feasible, as demonstrated by researchers.
How does ASLR prevent ROP attacks?
ASLR randomizes memory layouts, making gadget addresses unpredictable. Attackers must bypass ASLR through information disclosure (leaking addresses) or use position-independent gadgets. ASLR significantly complicates ROP exploitation but does not eliminate it.
What is Control Flow Guard (CFG)?
CFG is a Microsoft defense mechanism that validates indirect control flow transfers (indirect calls, returns). It restricts gadget chains by limiting valid return targets, though bypass techniques continue to be discovered.
Can modern defenses completely prevent ROP attacks?
Modern defenses (ASLR, CFG, code deduplication) significantly raise the bar for ROP exploitation but do not eliminate it completely. Defense-in-depth with multiple layers is essential.
What is a ROP gadget?
A ROP gadget is a short instruction sequence (typically 2-10 instructions) ending with a return statement. Gadgets are found in existing code and serve as building blocks for ROP chains.
Sources
- Shacham, H. (2007). The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86). In Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS 2007), pp. 552-561. DOI: 10.1145/1315245.1315313 ↗
- Roemer, R., Buchanan, E., Shacham, H., & Savage, S. (2012). Return-oriented programming: Systems, languages, and applications. ACM Transactions on Information and System Security (TISSEC), 15(1), 1-34. DOI: 10.1145/2133375.2133377 ↗
How to cite this page
ScholarGate. (2026, June 3). Return-Oriented Programming (ROP). ScholarGate. https://scholargate.app/en/cryptography/return-oriented-programming
Which method?
Set this method beside its closest kin and read them side by side — the library lays the books on the table; the choice is yours.
- Deep Packet InspectionCryptography↔ compare
- Differential CryptanalysisCryptography↔ compare
- Side-Channel AnalysisCryptography↔ compare