Jump-Oriented Programming.

A code-reuse exploitation technique (Bletsch et al., 2011) that chains gadgets ending in indirect jumps via a dispatcher, providing an alternative to ROP without using ret. It belongs to the Attacks & Threats category of cybersecurity.

A code-reuse exploitation technique (Bletsch et al., 2011) that chains gadgets ending in indirect jumps via a dispatcher, providing an alternative to ROP without using ret.

JOP was introduced by Bletsch, Jiang, Freeh and Liang in 2011 as a generalisation of Return-Oriented Programming. Instead of gadgets ending in ret, JOP uses gadgets ending in indirect jumps such as jmp [rax] and an attacker-controlled dispatcher gadget that walks through a table of gadget addresses. Because the call stack is never used to control flow, JOP defeats older mitigations like shadow stacks or stack canaries that target ret-based chains. Practical JOP chains have been demonstrated against Windows, Linux and embedded targets, often combined with information leaks to bypass ASLR. Modern hardware defences include CET/IBT (Intel) and BTI (ARM), which restrict indirect branch targets and break naive JOP chains.

Defences for Jump-Oriented Programming typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: JOP.