Is it possible to use ROP to call legitimate functions even if the stack is not executable?

I read about the hardware protection that blocks the CPU from jumping to stack address. But hacker may still edit the return address to an address in code memory that shouldn’t run at that moment.
For example;
#include<stdio.h>

Continue reading Is it possible to use ROP to call legitimate functions even if the stack is not executable?