Practical Considerations in Control-Flow Integrity Monitoring

• ABSTRACT:
  
  Control-flow integrity (CFI) checks ensure that programs respect their static call-graphs at runtime. A program might violate its call-graph due to malicious attacks such as shellcode injection or return-to-libc style exploits. CFI checking can also be beneficial during testing to discover properties of control-flow, as well as at deployment to detect malicious behavior. We present practical aspects of CFI checking, including advantages and disadvantages of the following: how to represent call-graphs, how to instrument CFI checks, and how to refine CFI checks to properties of control-flow. We discuss two implementations: one instrumenting the source code and the other instrumenting the compiler generated assembly, and we describe their performance. Our paper is meant to be a practical guide to CFI monitoring.

• BIBTEX:
  

  @InProceedings{diatchki-sectest,
    author =    {Iavor Diatchki and Lee Pike and Levent Erkök},
    title =     {Practical Considerations in Control-Flow Integrity Monitoring},
    booktitle = {Proceedings of the The Second International Workshop on Security Testing (SECTEST'2011)},
    publisher = {IEEE},
    year =      {2011},
    month =     {March},
    note =      {Preprint available at \url{https://leepike.github.io/pub_pages/sectest.html}},
  }
  

• PAPER DOWNLOAD: diatchki-sectest2011pdf