PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Clang Hardening Cheat Sheet - Ten Years Later

blog.quarkslab.com | research | #devsecops | #developer-security | #hardening | #llvm | #compiler | #security | #clang | #mitigations
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab updates its Clang Hardening Cheat Sheet a decade later with OpenSSF-recommended flags and newer mitigations against memory corruption, ROP/JOP and speculative execution attacks.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Let’s talk about CFI: clang edition
Trail of Bits explains Control Flow Integrity with clang 3.9: what CFI mitigations like cfi-icall and cfi-vcall enforce, their limitations, and the -flto plus -fsanitize=cfi build flags required.
research · blog.quarkslab.com
Extending LLVM's BOLT-based Binary Analyser to Validate Stack Variable Initialisation
Quarkslab extended LLVM's BOLT-based binary analyser for OSTIF with a scanner that validates -ftrivial-auto-var-init at the binary level, verifying stack-variable initialisation hardening.
research · blog.quarkslab.com
Obfuscation vs the Optimizer: An LLVM Middle-End Arms Race
A Quarkslab post on the tug-of-war between obfuscators and compiler optimizers: through LLVM's middle-end IR and passes, it shows how a single upstream commit can unravel an obfuscation.
research · blog.quarkslab.com
Implementing a Custom Directive Handler in Clang
How-to on implementing a custom #pragma directive handler in clang, used to drive an LLVM-based obfuscator while keeping sources compilable elsewhere; a tour of the preprocessing and parsing stages.
research · blog.quarkslab.com
SCAF - Source Code Analysis Framework based on Clang - Pre-alpha preview
A preview of SCAF, a Clang-based source code analysis framework: a Python API and GUI that store ASTs and metadata in a shared database, plus a make-process hook for accurate build context.
research · blog.quarkslab.com
A glance at compiler internals: Keep my memset
Why Clang/LLVM can delete your memset: tracing llvm.memset through Dead Store Elimination, the risk for code that wipes secrets, and the volatile function-pointer trick that keeps the wipe alive.
Back