blind rop? Well, if they are using AI they are unlikely to do this in a reasonable amount of time anyway. Also, not sure how one would go on with that if all protectors and pointers change every run and fork like on OpenBSD.