Control flow integrity for COTS binaries

TLDR

Control‑Flow Integrity (CFI) is a critical low‑level security property that can defeat most injected code attacks, including Return‑Oriented Programming, but prior implementations required compiler support or relocation/debug information. This work introduces a technique to apply CFI to stripped x86/Linux binaries. The technique relies on robust disassembly, static analysis, and transformation of large binaries to enforce CFI without compiler support. Our implementation is the first to protect complex shared libraries such as glibc, effectively blocks control‑flow hijack attacks, removes the vast majority of ROP gadgets, and has been validated on over 300 MB of binaries.

Abstract

Control-Flow Integrity (CFI) has been recognized as an important low-level security property. Its enforcement can defeat most injected and existing code attacks, including those based on Return-Oriented Programming (ROP). Previous implementations of CFI have required compiler support or the presence of relocation or debug information in the binary. In contrast, we present a technique for applying CFI to stripped binaries on ×86/Linux. Ours is the first work to apply CFI to complex shared libraries such as glibc. Through experimental evaluation, we demonstrate that our CFI implementation is effective against control-flow hijack attacks, and eliminates the vast majority of ROP gadgets. To achieve this result, we have developed robust techniques for disassembly, static analysis, and transformation of large binaries. Our techniques have been tested on over 300MB of binaries (executables and shared libraries).