&gt; <i>as an attacker can&#x27;t simply load an executable payload (typically, shellcode) in the address space of the exploited program and jump to it...</i><p>Very interesting read on how this works in practice: 
<a href="https:&#x2F;&#x2F;www.corelan.be&#x2F;index.php&#x2F;2010&#x2F;06&#x2F;16&#x2F;exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.corelan.be&#x2F;index.php&#x2F;2010&#x2F;06&#x2F;16&#x2F;exploit-writing-...</a>