Return oriented programming attack protection

A computer system for preventing return-oriented programming (ROP) attacks, the computer system comprising:

• one or more computer processors;
• one or more computer-readable storage media;
• program instructions stored on the computer-readable storage media for execution by at least one of the one or more processors, the program instructions comprising instructions to:
• analyze one or more addresses to identify one or more critical regions, wherein a critical region corresponds to an address that has been selected to be monitored for potential ROP attacks;
• responsive to identifying one or more critical regions, register the one or more critical regions;
• identify one or more critical functions, wherein a critical function corresponds to a function for which corresponding execution attempts will be selected to be analyzed as a potential ROP threat;
• instrument the one or more critical regions with ROP protection mechanisms;
• detect a critical function execution attempt on one or more of the identified critical regions;
• determine whether values associated with the critical function match corresponding expected values;
• and
• responsive to determining that values associated with the critical function do not match expected values, activate a return-oriented programming protection mechanism.