Return-oriented programming without returns
Stephen Checkoway, Lucas Davi, Alexandra Dmitrienko, Ahmad‐Reza Sadeghi, Hovav Shacham, Marcel Winandy · 2010
We show that on both the x86 and ARM architectures it is possible to mount return-oriented programming attacks without using return instructions. Our attacks instead make use of certain instruction sequences that behave like a return, which occur with sufficient frequency in large libraries on (x86) Linux and (ARM) Android to allow creation of Turing-complete gadget sets.