Detection and Defense Perspective

• {W^{}X / NX / DEP:} remove executable writable memory — the foundational mitigation.
• ASLR: randomizes addresses so attackers cannot reliably locate their payload.
• CFI (Control-Flow Integrity): validates indirect branches so control cannot jump to arbitrary injected code.
• Detection: NOP-sled signatures, entropy/anomaly checks, and memory scanners flag classic shellcode patterns.

Why exploits pivoted away from injected shellcode

With NX universal, attackers stopped injecting code and started

reusing existing executable code — ret2libc and

ROP (Return-Oriented Programming). That is Class 07.