Other meanings of Jump-oriented programming
Computer security
Jump-oriented programming (JOP) is a code-reuse exploit technique that achieves arbitrary computation by chaining sequences of indirect jump instructions (e.g., jmp eax or call eax), called gadgets, without injecting any new code. It was introduced in 2010 as a variant of return-oriented programming (ROP) that bypasses defenses relying on the detection of ret instructions, such as return-address stack monitoring or shadow stacks. JOP requires a springboard gadget that dispatches control flow between functional gadgets, placing it among the most general forms of code-reuse attacks.
Jump-oriented programming emerged from the need to bypass defenses that specifically target the ret instruction, the core gadget chaining mechanism in return-oriented programming. Modern countermeasures such as return-address stack protection (e.g., ROPecker) and shadow call stacks monitor for unusual ret behavior. JOP circumvents these by using only indirect jump and call instructions, which are not subject to the same scrutiny. The attack is particularly relevant on architectures where indirect jumps are abundant, such as x86, ARM, and MIPS, and where the instruction set is dense enough to find useful gadgets. The original paper by Checkoway, Davi, and colleagues demonstrated full Turing-complete computation on x86 using only jump gadgets, establishing JOP as a viable threat alongside ROP.
JOP relies on two types of gadgets: functional gadgets and a dispatcher gadget. A functional gadget is a sequence of instructions ending with an indirect jump, which performs a small operation (e.g., load, store, arithmetic) and then jumps to the next gadget address stored in a register or memory. The dispatcher gadget is a short sequence that repeatedly loads the next gadget pointer from a table (the gadget dispatcher table) and transfers control to it via an indirect jump. By arranging the gadget addresses in a table, an attacker can chain any sequence of functional gadgets and execute arbitrary logic. This technique requires precise control over memory (e.g., a buffer overflow that overwrites the dispatcher table) and knowledge of the target binary's available gadgets. Unlike ROP, JOP does not depend on the stack for control flow, making it resilient to stack-based defenses.
JOP is a direct successor to return-oriented programming, but it differs in its reliance on jmp and call rather than ret. This shift allows JOP to bypass hardware-assisted return-address protection (e.g., Intel CET) and software-based shadow stacks. However, JOP gadgets are generally harder to find than ROP gadgets because indirect jumps are less common than ret instructions in typical binaries. Another variant, call-oriented programming (COP), uses indirect call instructions as the primary gadget chaining mechanism. JOP can also be combined with ROP or COP in hybrid attacks. Defenses against JOP include control-flow integrity (CFI) that validates any indirect branch, and gadget-diversity reduction through compiler transformations. While JOP is less prevalent than ROP in real-world exploits, it remains a powerful technique for advanced adversaries targeting systems with high security.
Although JOP was first described in 2010, similar ideas appeared earlier: in 2008, researchers demonstrated a technique called "jump-oriented programming" on ARM using indirect branches. The original JOP paper also introduced a new class of gadgets called "SOC gadgets" (state-of-computation) that operate on registers without touching memory. JOP attacks have been demonstrated on embedded systems, including smartphones and IoT devices, where ROP gadgets may be scarce. A notable niche variant is "return-to-JOP", which uses a single ret to trigger the dispatcher. Defenses like CFI that cover all indirect transfers can theoretically prevent JOP, but practical implementations often leave gaps; for example, coarse-grained CFI may allow JOP gadget chains to execute within allowed targets. In 2015, researchers showed that JOP can be automated using the same gadget-finding tools as ROP, reducing the effort required. Despite its power, JOP is less commonly used in malware than ROP due to the relative difficulty of constructing dispatcher tables.
Help improve the encyclopedia. Reports go straight to the site manager.