Definition
Return-oriented programming ROP is an advanced persistent threat technique that allows an attacker to execute malicious code in the absence of typical code injection capabilities. It works by chaining together small, existing code fragments called gadgets, which are typically found within the target system's own libraries or executable code. These gadgets end with a return instruction, enabling the attacker to control the program's execution flow by carefully selecting and ordering them to perform arbitrary operations. ROP is critical for understanding sophisticated malware and exploit development, as it bypasses many common security defenses like non-executable memory. For instance, an attacker might use ROP to disable security software or steal sensitive data from a compromised system. Unlike simple buffer overflows that inject new code, ROP reuses existing code, making it harder to detect. This concept is frequently covered in cybersecurity certifications such as CompTIA Security+ and the CISSP exam.