I'm interested in ROP in the context of Java. For now, I don't consider the native code of the Java virtual machine.

Is return oriented programming applicable to pure Java code?

  • What about adding a tag for return-oriented programming? Commented Nov 19, 2014 at 11:08
  • When you build a ROP you're building it at the machine code level. I'm not sure what you mean by pure Java code in this context.
    – RoraΖ
    Commented Nov 19, 2014 at 12:31

1 Answer 1


In "pure Java", there is no buffer overflow or use-after-free or double-free or anything like that. This is what the "VM" part of "JVM" is about. ROP is something that you use to leverage an initial breakage whereby you succeeded in overwriting the "return address" for some function, and induced the CPU to jump where you want. By definition, these conditions cannot arise in "pure Java", so ROP is irrelevant. It cannot happen.

Of course, if the JVM implementation has an exploitable bug, or if native code is invoked, then everything about buffer overflows comes back. But then, you are talking about using ROP in some C/C++ code, and no longer about Java.

  • There's an awful lot of native code. :( I can't think of any public JVM vulnerability that wasn't to do with a native implementation where ROP or any pc corruption attack would be useful. Commented Nov 19, 2014 at 13:17
  • ROP is useful when you found a vulnerability that allows redirecting execution to an arbitrary point (e.g. a buffer overflow on the stack, that allows overwriting the "return address" slot), but then countermeasures such as ASLR and DEP prevent you from simply pushing your payload code as data and jumping into it. All of ROP is about reusing the existing code (from the application itself and its libraries) as "payload". Commented Nov 19, 2014 at 17:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .