1. A method of detecting a Return-Oriented Programming exploitation of an application, the method comprising, at a computer device: establishing a hooking rule to hook a code location relating to an electronic file stored in a computer readable medium in the form of a non-transitory memory; in the event that a control transfer of the code location relating to the electronic file is detected, comparing a code location address with values in a stack space freed by the control transfer and, in the event that the code location address and any of the values in the freed stack match, determining that the control transfer relates to a Return-Oriented Programming exploitation.