PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Let’s talk about CFI: Microsoft Edition

blog.trailofbits.com | blog | #ai-security | #microsoft | #windows | #cfi | #exploit-mitigation | #cfg | #visual-studio
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits examines Microsoft's Control Flow Guard (CFG): how the compiler identifies indirect branches, inserts validity checks, and what /guard:cf does and doesn't protect on Windows 10 x86-64.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Let’s talk about CFI: clang edition
Trail of Bits explains Control Flow Integrity with clang 3.9: what CFI mitigations like cfi-icall and cfi-vcall enforce, their limitations, and the -flto plus -fsanitize=cfi build flags required.
tool · github.com
LogonStealer: Windows Credential Provider DLL for Stealing Plaintext Passwords via CredProvDataModel Hooks
Demonstrates an effective post-exploitation technique targeting the modern Windows 11 WinRT logon architecture to harvest plaintext credentials while bypassing PPL.
blog · blog.trailofbits.com
The Challenges of Deploying Security Mitigations
Applying CFI to osquery exposed deployment cost: CFGuard took two CMake lines, while ClangCFI resisted weeks of effort due to stricter semantics, all-or-nothing granularity, and clang bugs.
blog · blog.trailofbits.com
2016 Year in Review
Trail of Bits' 2016 review: its DARPA Cyber Grand Challenge CRS audited zlib, osquery was ported to Windows, the Algo VPN and Protofuzz launched, CFI explained, and NYC's InfoSec community supported.
blog · bughunters.google.com
LLVM CFI and Cross-Language LLVM CFI Support for Rust
Google Bug Hunters partnered with the Rust community to add LLVM CFI and cross-language LLVM CFI (with KCFI variants) to the Rust compiler, strengthening control-flow integrity for Rust code.
blog · xbow.com
How Attackers Are Using AI & What Defenders Must Do
Attackers are running AI driven attack chains from recon to exploitation in minutes. Here’s what actually changed, and why defenders need AI pentesting to keep pace.
Back