Return-Oriented Programming: Exploits Without Code Injection(cseweb.ucsd.edu)
cseweb.ucsd.edu
Return-Oriented Programming: Exploits Without Code Injection
http://cseweb.ucsd.edu/~hovav/talks/blackhat08.html
3 comments
The interesting thing about return oriented programming is that it can even work on devices with harvard architecture, where code and user data are stored in completely separate memory areas (which was seen a a guarantee against code injection until quite recently) http://arxiv.org/abs/0901.3482
A similar paper on this by USCD was also submitted recently if you are interested.
http://news.ycombinator.com/item?id=1155954
http://news.ycombinator.com/item?id=1155954