Return-Oriented Programming.

Return-Oriented Programming (ROP) is a code-reuse exploit technique that chains short instruction sequences ending in RET to execute arbitrary computation without injecting new code. It belongs to the Application Security category of cybersecurity.

Return-Oriented Programming (ROP) is a code-reuse exploit technique that chains short instruction sequences ending in RET to execute arbitrary computation without injecting new code.

Hovav Shacham introduced ROP in 2007 to bypass DEP/W^X mitigations. The attacker corrupts a stack and writes a chain of addresses, each pointing to a short gadget ending in RET. After each gadget runs, RET pops the next gadget address, producing a Turing-complete computation built only from existing executable bytes (libc, libraries, the program). Variants include JOP (jumps), COP (calls), and SROP (signal frames). ROP is the principal reason ASLR, CFI, stack canaries, shadow stacks, Intel CET and memory-safe languages were standardized; defenses target either gadget availability, control-flow integrity, or memory safety at the source.

Defences for Return-Oriented Programming typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: ROP, Code reuse attack, Return-to-libc.