ROP Is Turing-Complete; Its Cousins JOP and COP

• With enough gadgets you have load/store, arithmetic, and conditional control flow: ROP is Turing-complete. You can, in principle, compute anything without injecting a single instruction.
• Variants that dodge ret-based defenses:
• JOP (Jump-Oriented Programming): gadgets end in jmp reg; a "dispatcher" gadget sequences them.
• COP (Call-Oriented Programming): gadgets end in call reg.
• These exist because some defenses specifically watch ret (e.g. shadow stacks) — attackers adapt by not using it.