Tag Info

New answers tagged


No. Actually, most RoP attacks make use of existing codes (former return-into-libc-attacks). So, the RoP gadgets are snippets of existing code and have to be executable.


Making the injected payload "not executable" is what Data Execution Prevention is about. There are various techniques to achieve that, depending on what the underlying hardware can do. On most architectures, this will be done through the MMU: pages that are supposed to contain "data" (e.g. the stack) are marked as non-executable. Old x86 CPU makes DEP a bit ...

Top 50 recent answers are included