1. A system for detecting the presence of a return-oriented programming (ROP) payload in data, comprising: a hardware processor that: identifies a potential gadget address space; initializes a virtual address space of an emulator with instructions from the potential gadget address space; determines if a piece of the data corresponds to an address of the potential gadget address space; and in response to determining that the piece of the data corresponds to an address of the potential gadget address space: for each instruction of a plurality of instructions beginning at the address: determines whether the instruction is valid; counts the instruction as part of an instruction count; and determines whether the instruction count meets at least one threshold; in response to determining that one of the plurality of instructions is valid and determining that the instruction count meets the at least one threshold, increases a gadget count; and indicates that an ROP payload is present in the data in response to the gadget count meeting a threshold greater than one.