This session will demonstrate the practical applications of return-oriented techniques for exploit payloads against systems with modern exploit mitigation technologies such as Microsoft's DEP and ASLR as well as the iPhone's non-executable memory and code signing. Most importantly, this session will demonstrate that for defenders it is more important to prevent malicious computations than injection of malicious code. For attackers it is becoming more important to control ESP than EIP.