blueteamsec

On Windows, ROP is often used solely to bypass Data Execution Prevention, rather than realizing its full potential; indeed, the bulk of advanced, malicious functionality is typically invoked through shellcode.

That's because writing ROP chains sucks, especially if you have complex constraints on the chain such as bad bytes or restricted values in the payload. Not having to write as much of it in the weird machine's language is a good thing. It's well-known that any nontrivial binary will be turing-complete in its available gadgets. We can already implement anything in principle, which leaves me feeling slightly confused as to the main contribution of this paper. It's cute though!