diff --git a/lib/rex/ropbuilder/rop.rb b/lib/rex/ropbuilder/rop.rb
index 6d24a40193..aa164068ad 100644
--- a/lib/rex/ropbuilder/rop.rb
+++ b/lib/rex/ropbuilder/rop.rb
@@ -203,7 +203,7 @@ class RopCollect < RopBase
 
 			xtra = insn.bin_length
 
-			num.step(0, -1) do |x|
+			num.downto(0) do |x|
 				addr = ea - x
 
 				# get the disassembled instruction at this address