Methods, devices, and systems for detecting return oriented programming exploits

A processing device, comprising:

• means for executing an unintended sequence of code snippets in a processing circuit, each code snippet including at least one executable instruction including a control transfer instruction, wherein one or more of the code snippets includes a modified control transfer instruction different from an originally intended control transfer instruction and at least one code snippet of the plurality is a non-cached code snippet not found in a cache memory;
• and
• means for developing an instruction loading profile by monitoring instruction fetches relative to cache misses, where the cache misses are fetched instructions absent from the cache memory on the instruction fetch.

A machine-readable medium having instructions stored thereon, which when executed by a processing circuit cause the processing circuit to:

• execute an unintended sequence of code snippets, each code snippet including at least one executable instruction including a control transfer instruction, wherein one or more of the code snippets includes a modified control transfer instruction different from an originally intended control transfer instruction and at least one code snippet of the plurality is a non-cached code snippet not found in a cache memory;
• and
• develop an instruction loading profile by monitoring instruction fetches relative to cache misses, where the cache misses are fetched instructions absent from the cache memory on the instruction fetch.