$$Part II: Return$-$Oriented Programming

Performing code$-$injection attacks on program RTARGET is much more difficult than it is for CTARGET,

because it uses two techniques to thwart such attacks:

$$ It uses randomization so that the stack positions differ from one run to another. This makes it impos$-$

sible to determine where your injected code will be located.

$$ It marks the section of memory holding the stack as nonexecutable, so even if you could set the

program counter to the start of your injected code, the program would fail with a segmentation fault.

Fortunately, clever people have devised strategies for getting useful things done in a program by executing

existing code, rather than injecting new code. The most general form of this is referred to as return$-$oriented

programming $($ROP$)[1,2].$ The strategy with ROP is to identify byte sequences within an existing program