I noticed that exploits which use Return Oriented Programming always find the gadgets in libraries. I wonder if it is possible to use gadgets from the executable (.exe) itself?
I believe the reason is "it's easiest to use instruction sequences from the libraries, because the libraries are so common and they've already been scanned."
There are just a handful of Microsoft-provided C-runtime library files. If they provide a complete enough instruction set, why work harder?
Yes, absolutely, of course it is possible to use gadgets that are from the executable itself. You can use any code that is mapped into the address space of the program in executable form (i.e., where it's possible to execute the code -- if the system is using DEP, this excludes anything that has the non-executable bit set). That includes the original executables, any libraries that are loaded into memory, and anything else in memory that has its permissions set to executable.