CINXE.COM

<!DOCTYPE html> <html class="client-nojs vector-feature-language-in-header-enabled vector-feature-language-in-main-page-header-disabled vector-feature-sticky-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 vector-feature-night-mode-enabled skin-theme-clientpref-day vector-toc-available" lang="en" dir="ltr"> <head> <meta charset="UTF-8"> <title>Control-flow integrity - Wikipedia</title> <script>(function(){var className="client-js vector-feature-language-in-header-enabled vector-feature-language-in-main-page-header-disabled vector-feature-sticky-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 vector-feature-night-mode-enabled skin-theme-clientpref-day vector-toc-available";var cookie=document.cookie.match(/(?:^|; )enwikimwclientpreferences=([^;]+)/);if(cookie){cookie[1].split('%2C').forEach(function(pref){className=className.replace(new RegExp('(^| )'+pref.replace(/-clientpref-\w+$|[^\w-]+/g,'')+'-clientpref-\\w+( |$)'),'$1'+pref+'$2');});}document.documentElement.className=className;}());RLCONF={"wgBreakFrames":false,"wgSeparatorTransformTable":["",""],"wgDigitTransformTable":["",""],"wgDefaultDateFormat":"dmy", "wgMonthNames":["","January","February","March","April","May","June","July","August","September","October","November","December"],"wgRequestId":"503e3858-5e25-4c60-91c7-7a2305f39659","wgCanonicalNamespace":"","wgCanonicalSpecialPageName":false,"wgNamespaceNumber":0,"wgPageName":"Control-flow_integrity","wgTitle":"Control-flow integrity","wgCurRevisionId":1252464912,"wgRevisionId":1252464912,"wgArticleId":50695372,"wgIsArticle":true,"wgIsRedirect":false,"wgAction":"view","wgUserName":null,"wgUserGroups":["*"],"wgCategories":["CS1 German-language sources (de)","Articles with short description","Short description matches Wikidata","Articles to be expanded from September 2020","All articles to be expanded","Articles to be expanded from January 2021","Computer security","Control flow integrity"],"wgPageViewLanguage":"en","wgPageContentLanguage":"en","wgPageContentModel":"wikitext","wgRelevantPageName":"Control-flow_integrity","wgRelevantArticleId":50695372,"wgIsProbablyEditable":true, "wgRelevantPageIsProbablyEditable":true,"wgRestrictionEdit":[],"wgRestrictionMove":[],"wgNoticeProject":"wikipedia","wgCiteReferencePreviewsActive":false,"wgFlaggedRevsParams":{"tags":{"status":{"levels":1}}},"wgMediaViewerOnClick":true,"wgMediaViewerEnabledByDefault":true,"wgPopupsFlags":0,"wgVisualEditor":{"pageLanguageCode":"en","pageLanguageDir":"ltr","pageVariantFallbacks":"en"},"wgMFDisplayWikibaseDescriptions":{"search":true,"watchlist":true,"tagline":false,"nearby":true},"wgWMESchemaEditAttemptStepOversample":false,"wgWMEPageLength":20000,"wgRelatedArticlesCompat":[],"wgCentralAuthMobileDomain":false,"wgEditSubmitButtonLabelPublish":true,"wgULSPosition":"interlanguage","wgULSisCompactLinksEnabled":false,"wgVector2022LanguageInHeader":true,"wgULSisLanguageSelectorEmpty":false,"wgWikibaseItemId":"Q27627868","wgCheckUserClientHintsHeadersJsApi":["brands","architecture","bitness","fullVersionList","mobile","model","platform","platformVersion"],"GEHomepageSuggestedEditsEnableTopics" :true,"wgGETopicsMatchModeEnabled":false,"wgGEStructuredTaskRejectionReasonTextInputEnabled":false,"wgGELevelingUpEnabledForUser":false};RLSTATE={"ext.globalCssJs.user.styles":"ready","site.styles":"ready","user.styles":"ready","ext.globalCssJs.user":"ready","user":"ready","user.options":"loading","ext.cite.styles":"ready","skins.vector.search.codex.styles":"ready","skins.vector.styles":"ready","skins.vector.icons":"ready","ext.wikimediamessages.styles":"ready","ext.visualEditor.desktopArticleTarget.noscript":"ready","ext.uls.interlanguage":"ready","wikibase.client.init":"ready","ext.wikimediaBadges":"ready"};RLPAGEMODULES=["ext.cite.ux-enhancements","site","mediawiki.page.ready","mediawiki.toc","skins.vector.js","ext.centralNotice.geoIP","ext.centralNotice.startUp","ext.gadget.ReferenceTooltips","ext.gadget.switcher","ext.urlShortener.toolbar","ext.centralauth.centralautologin","mmv.bootstrap","ext.popups","ext.visualEditor.desktopArticleTarget.init","ext.visualEditor.targetLoader", "ext.echo.centralauth","ext.eventLogging","ext.wikimediaEvents","ext.navigationTiming","ext.uls.interface","ext.cx.eventlogging.campaigns","ext.cx.uls.quick.actions","wikibase.client.vector-2022","ext.checkUser.clientHints","ext.quicksurveys.init","ext.growthExperiments.SuggestedEditSession","wikibase.sidebar.tracking"];</script> <script>(RLQ=window.RLQ||[]).push(function(){mw.loader.impl(function(){return["user.options@12s5i",function($,jQuery,require,module){mw.user.tokens.set({"patrolToken":"+\\","watchToken":"+\\","csrfToken":"+\\"}); }];});});</script> <link rel="stylesheet" href="/w/load.php?lang=en&modules=ext.cite.styles%7Cext.uls.interlanguage%7Cext.visualEditor.desktopArticleTarget.noscript%7Cext.wikimediaBadges%7Cext.wikimediamessages.styles%7Cskins.vector.icons%2Cstyles%7Cskins.vector.search.codex.styles%7Cwikibase.client.init&only=styles&skin=vector-2022"> <script async="" src="/w/load.php?lang=en&modules=startup&only=scripts&raw=1&skin=vector-2022"></script> <meta name="ResourceLoaderDynamicStyles" content=""> <link rel="stylesheet" href="/w/load.php?lang=en&modules=site.styles&only=styles&skin=vector-2022"> <meta name="generator" content="MediaWiki 1.44.0-wmf.4"> <meta name="referrer" content="origin"> <meta name="referrer" content="origin-when-cross-origin"> <meta name="robots" content="max-image-preview:standard"> <meta name="format-detection" content="telephone=no"> <meta name="viewport" content="width=1120"> <meta property="og:title" content="Control-flow integrity - Wikipedia"> <meta property="og:type" content="website"> <link rel="preconnect" href="//upload.wikimedia.org"> <link rel="alternate" media="only screen and (max-width: 640px)" href="//en.m.wikipedia.org/wiki/Control-flow_integrity"> <link rel="alternate" type="application/x-wiki" title="Edit this page" href="/w/index.php?title=Control-flow_integrity&action=edit"> <link rel="apple-touch-icon" href="/static/apple-touch/wikipedia.png"> <link rel="icon" href="/static/favicon/wikipedia.ico"> <link rel="search" type="application/opensearchdescription+xml" href="/w/rest.php/v1/search" title="Wikipedia (en)"> <link rel="EditURI" type="application/rsd+xml" href="//en.wikipedia.org/w/api.php?action=rsd"> <link rel="canonical" href="https://en.wikipedia.org/wiki/Control-flow_integrity"> <link rel="license" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en"> <link rel="alternate" type="application/atom+xml" title="Wikipedia Atom feed" href="/w/index.php?title=Special:RecentChanges&feed=atom"> <link rel="dns-prefetch" href="//meta.wikimedia.org" /> <link rel="dns-prefetch" href="//login.wikimedia.org"> </head> <body class="skin--responsive skin-vector skin-vector-search-vue mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject mw-editable page-Control-flow_integrity rootpage-Control-flow_integrity skin-vector-2022 action-view"><a class="mw-jump-link" href="#bodyContent">Jump to content</a> <div class="vector-header-container"> <header class="vector-header mw-header"> <div class="vector-header-start"> <nav class="vector-main-menu-landmark" aria-label="Site"> <div id="vector-main-menu-dropdown" class="vector-dropdown vector-main-menu-dropdown vector-button-flush-left vector-button-flush-right" > <input type="checkbox" id="vector-main-menu-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-main-menu-dropdown" class="vector-dropdown-checkbox " aria-label="Main menu" > <label id="vector-main-menu-dropdown-label" for="vector-main-menu-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only " aria-hidden="true" ><span class="vector-icon mw-ui-icon-menu mw-ui-icon-wikimedia-menu"></span> <span class="vector-dropdown-label-text">Main menu</span> </label> <div class="vector-dropdown-content"> <div id="vector-main-menu-unpinned-container" class="vector-unpinned-container"> <div id="vector-main-menu" class="vector-main-menu vector-pinnable-element"> <div class="vector-pinnable-header vector-main-menu-pinnable-header vector-pinnable-header-unpinned" data-feature-name="main-menu-pinned" data-pinnable-element-id="vector-main-menu" data-pinned-container-id="vector-main-menu-pinned-container" data-unpinned-container-id="vector-main-menu-unpinned-container" > <div class="vector-pinnable-header-label">Main menu</div> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-pin-button" data-event-name="pinnable-header.vector-main-menu.pin">move to sidebar</button> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-unpin-button" data-event-name="pinnable-header.vector-main-menu.unpin">hide</button> </div> <div id="p-navigation" class="vector-menu mw-portlet mw-portlet-navigation" > <div class="vector-menu-heading"> Navigation </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="n-mainpage-description" class="mw-list-item"><a href="/wiki/Main_Page" title="Visit the main page [z]" accesskey="z"><span>Main page</span></a></li><li id="n-contents" class="mw-list-item"><a href="/wiki/Wikipedia:Contents" title="Guides to browsing Wikipedia"><span>Contents</span></a></li><li id="n-currentevents" class="mw-list-item"><a href="/wiki/Portal:Current_events" title="Articles related to current events"><span>Current events</span></a></li><li id="n-randompage" class="mw-list-item"><a href="/wiki/Special:Random" title="Visit a randomly selected article [x]" accesskey="x"><span>Random article</span></a></li><li id="n-aboutsite" class="mw-list-item"><a href="/wiki/Wikipedia:About" title="Learn about Wikipedia and how it works"><span>About Wikipedia</span></a></li><li id="n-contactpage" class="mw-list-item"><a href="//en.wikipedia.org/wiki/Wikipedia:Contact_us" title="How to contact Wikipedia"><span>Contact us</span></a></li> </ul> </div> </div> <div id="p-interaction" class="vector-menu mw-portlet mw-portlet-interaction" > <div class="vector-menu-heading"> Contribute </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="n-help" class="mw-list-item"><a href="/wiki/Help:Contents" title="Guidance on how to use and edit Wikipedia"><span>Help</span></a></li><li id="n-introduction" class="mw-list-item"><a href="/wiki/Help:Introduction" title="Learn how to edit Wikipedia"><span>Learn to edit</span></a></li><li id="n-portal" class="mw-list-item"><a href="/wiki/Wikipedia:Community_portal" title="The hub for editors"><span>Community portal</span></a></li><li id="n-recentchanges" class="mw-list-item"><a href="/wiki/Special:RecentChanges" title="A list of recent changes to Wikipedia [r]" accesskey="r"><span>Recent changes</span></a></li><li id="n-upload" class="mw-list-item"><a href="/wiki/Wikipedia:File_upload_wizard" title="Add images or other media for use on Wikipedia"><span>Upload file</span></a></li> </ul> </div> </div> </div> </div> </div> </div> </nav> <a href="/wiki/Main_Page" class="mw-logo"> <img class="mw-logo-icon" src="/static/images/icons/wikipedia.png" alt="" aria-hidden="true" height="50" width="50"> <span class="mw-logo-container skin-invert"> <img class="mw-logo-wordmark" alt="Wikipedia" src="/static/images/mobile/copyright/wikipedia-wordmark-en.svg" style="width: 7.5em; height: 1.125em;"> <img class="mw-logo-tagline" alt="The Free Encyclopedia" src="/static/images/mobile/copyright/wikipedia-tagline-en.svg" width="117" height="13" style="width: 7.3125em; height: 0.8125em;"> </span> </a> </div> <div class="vector-header-end"> <div id="p-search" role="search" class="vector-search-box-vue vector-search-box-collapses vector-search-box-show-thumbnail vector-search-box-auto-expand-width vector-search-box"> <a href="/wiki/Special:Search" class="cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only search-toggle" title="Search Wikipedia [f]" accesskey="f"><span class="vector-icon mw-ui-icon-search mw-ui-icon-wikimedia-search"></span> <span>Search</span> </a> <div class="vector-typeahead-search-container"> <div class="cdx-typeahead-search cdx-typeahead-search--show-thumbnail cdx-typeahead-search--auto-expand-width"> <form action="/w/index.php" id="searchform" class="cdx-search-input cdx-search-input--has-end-button"> <div id="simpleSearch" class="cdx-search-input__input-wrapper" data-search-loc="header-moved"> <div class="cdx-text-input cdx-text-input--has-start-icon"> <input class="cdx-text-input__input" type="search" name="search" placeholder="Search Wikipedia" aria-label="Search Wikipedia" autocapitalize="sentences" title="Search Wikipedia [f]" accesskey="f" id="searchInput" > <span class="cdx-text-input__icon cdx-text-input__start-icon"></span> </div> <input type="hidden" name="title" value="Special:Search"> </div> <button class="cdx-button cdx-search-input__end-button">Search</button> </form> </div> </div> </div> <nav class="vector-user-links vector-user-links-wide" aria-label="Personal tools"> <div class="vector-user-links-main"> <div id="p-vector-user-menu-preferences" class="vector-menu mw-portlet emptyPortlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> </ul> </div> </div> <div id="p-vector-user-menu-userpage" class="vector-menu mw-portlet emptyPortlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> </ul> </div> </div> <nav class="vector-appearance-landmark" aria-label="Appearance"> <div id="vector-appearance-dropdown" class="vector-dropdown " title="Change the appearance of the page's font size, width, and color" > <input type="checkbox" id="vector-appearance-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-appearance-dropdown" class="vector-dropdown-checkbox " aria-label="Appearance" > <label id="vector-appearance-dropdown-label" for="vector-appearance-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only " aria-hidden="true" ><span class="vector-icon mw-ui-icon-appearance mw-ui-icon-wikimedia-appearance"></span> <span class="vector-dropdown-label-text">Appearance</span> </label> <div class="vector-dropdown-content"> <div id="vector-appearance-unpinned-container" class="vector-unpinned-container"> </div> </div> </div> </nav> <div id="p-vector-user-menu-notifications" class="vector-menu mw-portlet emptyPortlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> </ul> </div> </div> <div id="p-vector-user-menu-overflow" class="vector-menu mw-portlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="pt-sitesupport-2" class="user-links-collapsible-item mw-list-item user-links-collapsible-item"><a data-mw="interface" href="https://donate.wikimedia.org/wiki/Special:FundraiserRedirector?utm_source=donate&utm_medium=sidebar&utm_campaign=C13_en.wikipedia.org&uselang=en" class=""><span>Donate</span></a> </li> <li id="pt-createaccount-2" class="user-links-collapsible-item mw-list-item user-links-collapsible-item"><a data-mw="interface" href="/w/index.php?title=Special:CreateAccount&returnto=Control-flow+integrity" title="You are encouraged to create an account and log in; however, it is not mandatory" class=""><span>Create account</span></a> </li> <li id="pt-login-2" class="user-links-collapsible-item mw-list-item user-links-collapsible-item"><a data-mw="interface" href="/w/index.php?title=Special:UserLogin&returnto=Control-flow+integrity" title="You're encouraged to log in; however, it's not mandatory. [o]" accesskey="o" class=""><span>Log in</span></a> </li> </ul> </div> </div> </div> <div id="vector-user-links-dropdown" class="vector-dropdown vector-user-menu vector-button-flush-right vector-user-menu-logged-out" title="Log in and more options" > <input type="checkbox" id="vector-user-links-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-user-links-dropdown" class="vector-dropdown-checkbox " aria-label="Personal tools" > <label id="vector-user-links-dropdown-label" for="vector-user-links-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only " aria-hidden="true" ><span class="vector-icon mw-ui-icon-ellipsis mw-ui-icon-wikimedia-ellipsis"></span> <span class="vector-dropdown-label-text">Personal tools</span> </label> <div class="vector-dropdown-content"> <div id="p-personal" class="vector-menu mw-portlet mw-portlet-personal user-links-collapsible-item" title="User menu" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="pt-sitesupport" class="user-links-collapsible-item mw-list-item"><a href="https://donate.wikimedia.org/wiki/Special:FundraiserRedirector?utm_source=donate&utm_medium=sidebar&utm_campaign=C13_en.wikipedia.org&uselang=en"><span>Donate</span></a></li><li id="pt-createaccount" class="user-links-collapsible-item mw-list-item"><a href="/w/index.php?title=Special:CreateAccount&returnto=Control-flow+integrity" title="You are encouraged to create an account and log in; however, it is not mandatory"><span class="vector-icon mw-ui-icon-userAdd mw-ui-icon-wikimedia-userAdd"></span> <span>Create account</span></a></li><li id="pt-login" class="user-links-collapsible-item mw-list-item"><a href="/w/index.php?title=Special:UserLogin&returnto=Control-flow+integrity" title="You're encouraged to log in; however, it's not mandatory. [o]" accesskey="o"><span class="vector-icon mw-ui-icon-logIn mw-ui-icon-wikimedia-logIn"></span> <span>Log in</span></a></li> </ul> </div> </div> <div id="p-user-menu-anon-editor" class="vector-menu mw-portlet mw-portlet-user-menu-anon-editor" > <div class="vector-menu-heading"> Pages for logged out editors <a href="/wiki/Help:Introduction" aria-label="Learn more about editing"><span>learn more</span></a> </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="pt-anoncontribs" class="mw-list-item"><a href="/wiki/Special:MyContributions" title="A list of edits made from this IP address [y]" accesskey="y"><span>Contributions</span></a></li><li id="pt-anontalk" class="mw-list-item"><a href="/wiki/Special:MyTalk" title="Discussion about edits from this IP address [n]" accesskey="n"><span>Talk</span></a></li> </ul> </div> </div> </div> </div> </nav> </div> </header> </div> <div class="mw-page-container"> <div class="mw-page-container-inner"> <div class="vector-sitenotice-container"> <div id="siteNotice"></div> </div> <div class="vector-column-start"> <div class="vector-main-menu-container"> <div id="mw-navigation"> <nav id="mw-panel" class="vector-main-menu-landmark" aria-label="Site"> <div id="vector-main-menu-pinned-container" class="vector-pinned-container"> </div> </nav> </div> </div> <div class="vector-sticky-pinned-container"> <nav id="mw-panel-toc" aria-label="Contents" data-event-name="ui.sidebar-toc" class="mw-table-of-contents-container vector-toc-landmark"> <div id="vector-toc-pinned-container" class="vector-pinned-container"> <div id="vector-toc" class="vector-toc vector-pinnable-element"> <div class="vector-pinnable-header vector-toc-pinnable-header vector-pinnable-header-pinned" data-feature-name="toc-pinned" data-pinnable-element-id="vector-toc" > <h2 class="vector-pinnable-header-label">Contents</h2> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-pin-button" data-event-name="pinnable-header.vector-toc.pin">move to sidebar</button> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-unpin-button" data-event-name="pinnable-header.vector-toc.unpin">hide</button> </div> <ul class="vector-toc-contents" id="mw-panel-toc-list"> <li id="toc-mw-content-text" class="vector-toc-list-item vector-toc-level-1"> <a href="#" class="vector-toc-link"> <div class="vector-toc-text">(Top)</div> </a> </li> <li id="toc-Background" class="vector-toc-list-item vector-toc-level-1 vector-toc-list-item-expanded"> <a class="vector-toc-link" href="#Background"> <div class="vector-toc-text"> <span class="vector-toc-numb">1</span> <span>Background</span> </div> </a> <ul id="toc-Background-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Techniques" class="vector-toc-list-item vector-toc-level-1 vector-toc-list-item-expanded"> <a class="vector-toc-link" href="#Techniques"> <div class="vector-toc-text"> <span class="vector-toc-numb">2</span> <span>Techniques</span> </div> </a> <ul id="toc-Techniques-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Implementations" class="vector-toc-list-item vector-toc-level-1 vector-toc-list-item-expanded"> <a class="vector-toc-link" href="#Implementations"> <div class="vector-toc-text"> <span class="vector-toc-numb">3</span> <span>Implementations</span> </div> </a> <button aria-controls="toc-Implementations-sublist" class="cdx-button cdx-button--weight-quiet cdx-button--icon-only vector-toc-toggle"> <span class="vector-icon mw-ui-icon-wikimedia-expand"></span> <span>Toggle Implementations subsection</span> </button> <ul id="toc-Implementations-sublist" class="vector-toc-list"> <li id="toc-LLVM/Clang" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#LLVM/Clang"> <div class="vector-toc-text"> <span class="vector-toc-numb">3.1</span> <span>LLVM/Clang</span> </div> </a> <ul id="toc-LLVM/Clang-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Intel_Control-flow_Enforcement_Technology" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Intel_Control-flow_Enforcement_Technology"> <div class="vector-toc-text"> <span class="vector-toc-numb">3.2</span> <span>Intel Control-flow Enforcement Technology</span> </div> </a> <ul id="toc-Intel_Control-flow_Enforcement_Technology-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Microsoft_Control_Flow_Guard" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Microsoft_Control_Flow_Guard"> <div class="vector-toc-text"> <span class="vector-toc-numb">3.3</span> <span>Microsoft Control Flow Guard</span> </div> </a> <ul id="toc-Microsoft_Control_Flow_Guard-sublist" class="vector-toc-list"> <li id="toc-Implementation_details" class="vector-toc-list-item vector-toc-level-3"> <a class="vector-toc-link" href="#Implementation_details"> <div class="vector-toc-text"> <span class="vector-toc-numb">3.3.1</span> <span>Implementation details</span> </div> </a> <ul id="toc-Implementation_details-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Bypass_techniques" class="vector-toc-list-item vector-toc-level-3"> <a class="vector-toc-link" href="#Bypass_techniques"> <div class="vector-toc-text"> <span class="vector-toc-numb">3.3.2</span> <span>Bypass techniques</span> </div> </a> <ul id="toc-Bypass_techniques-sublist" class="vector-toc-list"> </ul> </li> </ul> </li> <li id="toc-Microsoft_eXtended_Flow_Guard" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Microsoft_eXtended_Flow_Guard"> <div class="vector-toc-text"> <span class="vector-toc-numb">3.4</span> <span>Microsoft eXtended Flow Guard</span> </div> </a> <ul id="toc-Microsoft_eXtended_Flow_Guard-sublist" class="vector-toc-list"> </ul> </li> </ul> </li> <li id="toc-See_also" class="vector-toc-list-item vector-toc-level-1 vector-toc-list-item-expanded"> <a class="vector-toc-link" href="#See_also"> <div class="vector-toc-text"> <span class="vector-toc-numb">4</span> <span>See also</span> </div> </a> <ul id="toc-See_also-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-References" class="vector-toc-list-item vector-toc-level-1 vector-toc-list-item-expanded"> <a class="vector-toc-link" href="#References"> <div class="vector-toc-text"> <span class="vector-toc-numb">5</span> <span>References</span> </div> </a> <ul id="toc-References-sublist" class="vector-toc-list"> </ul> </li> </ul> </div> </div> </nav> </div> </div> <div class="mw-content-container"> <main id="content" class="mw-body"> <header class="mw-body-header vector-page-titlebar"> <nav aria-label="Contents" class="vector-toc-landmark"> <div id="vector-page-titlebar-toc" class="vector-dropdown vector-page-titlebar-toc vector-button-flush-left" > <input type="checkbox" id="vector-page-titlebar-toc-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-page-titlebar-toc" class="vector-dropdown-checkbox " aria-label="Toggle the table of contents" > <label id="vector-page-titlebar-toc-label" for="vector-page-titlebar-toc-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only " aria-hidden="true" ><span class="vector-icon mw-ui-icon-listBullet mw-ui-icon-wikimedia-listBullet"></span> <span class="vector-dropdown-label-text">Toggle the table of contents</span> </label> <div class="vector-dropdown-content"> <div id="vector-page-titlebar-toc-unpinned-container" class="vector-unpinned-container"> </div> </div> </div> </nav> <h1 id="firstHeading" class="firstHeading mw-first-heading"><span class="mw-page-title-main">Control-flow integrity</span></h1> <div id="p-lang-btn" class="vector-dropdown mw-portlet mw-portlet-lang" > <input type="checkbox" id="p-lang-btn-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-p-lang-btn" class="vector-dropdown-checkbox mw-interlanguage-selector" aria-label="Go to an article in another language. Available in 1 language" > <label id="p-lang-btn-label" for="p-lang-btn-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--action-progressive mw-portlet-lang-heading-1" aria-hidden="true" ><span class="vector-icon mw-ui-icon-language-progressive mw-ui-icon-wikimedia-language-progressive"></span> <span class="vector-dropdown-label-text">1 language</span> </label> <div class="vector-dropdown-content"> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li class="interlanguage-link interwiki-ru mw-list-item"><a href="https://ru.wikipedia.org/wiki/Control-flow_integrity" title="Control-flow integrity – Russian" lang="ru" hreflang="ru" data-title="Control-flow integrity" data-language-autonym="Русский" data-language-local-name="Russian" class="interlanguage-link-target"><span>Русский</span></a></li> </ul> <div class="after-portlet after-portlet-lang"><span class="wb-langlinks-edit wb-langlinks-link"><a href="https://www.wikidata.org/wiki/Special:EntityPage/Q27627868#sitelinks-wikipedia" title="Edit interlanguage links" class="wbc-editpage">Edit links</a></span></div> </div> </div> </div> </header> <div class="vector-page-toolbar"> <div class="vector-page-toolbar-container"> <div id="left-navigation"> <nav aria-label="Namespaces"> <div id="p-associated-pages" class="vector-menu vector-menu-tabs mw-portlet mw-portlet-associated-pages" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="ca-nstab-main" class="selected vector-tab-noicon mw-list-item"><a href="/wiki/Control-flow_integrity" title="View the content page [c]" accesskey="c"><span>Article</span></a></li><li id="ca-talk" class="vector-tab-noicon mw-list-item"><a href="/wiki/Talk:Control-flow_integrity" rel="discussion" title="Discuss improvements to the content page [t]" accesskey="t"><span>Talk</span></a></li> </ul> </div> </div> <div id="vector-variants-dropdown" class="vector-dropdown emptyPortlet" > <input type="checkbox" id="vector-variants-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-variants-dropdown" class="vector-dropdown-checkbox " aria-label="Change language variant" > <label id="vector-variants-dropdown-label" for="vector-variants-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet" aria-hidden="true" ><span class="vector-dropdown-label-text">English</span> </label> <div class="vector-dropdown-content"> <div id="p-variants" class="vector-menu mw-portlet mw-portlet-variants emptyPortlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> </ul> </div> </div> </div> </div> </nav> </div> <div id="right-navigation" class="vector-collapsible"> <nav aria-label="Views"> <div id="p-views" class="vector-menu vector-menu-tabs mw-portlet mw-portlet-views" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="ca-view" class="selected vector-tab-noicon mw-list-item"><a href="/wiki/Control-flow_integrity"><span>Read</span></a></li><li id="ca-edit" class="vector-tab-noicon mw-list-item"><a href="/w/index.php?title=Control-flow_integrity&action=edit" title="Edit this page [e]" accesskey="e"><span>Edit</span></a></li><li id="ca-history" class="vector-tab-noicon mw-list-item"><a href="/w/index.php?title=Control-flow_integrity&action=history" title="Past revisions of this page [h]" accesskey="h"><span>View history</span></a></li> </ul> </div> </div> </nav> <nav class="vector-page-tools-landmark" aria-label="Page tools"> <div id="vector-page-tools-dropdown" class="vector-dropdown vector-page-tools-dropdown" > <input type="checkbox" id="vector-page-tools-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-page-tools-dropdown" class="vector-dropdown-checkbox " aria-label="Tools" > <label id="vector-page-tools-dropdown-label" for="vector-page-tools-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet" aria-hidden="true" ><span class="vector-dropdown-label-text">Tools</span> </label> <div class="vector-dropdown-content"> <div id="vector-page-tools-unpinned-container" class="vector-unpinned-container"> <div id="vector-page-tools" class="vector-page-tools vector-pinnable-element"> <div class="vector-pinnable-header vector-page-tools-pinnable-header vector-pinnable-header-unpinned" data-feature-name="page-tools-pinned" data-pinnable-element-id="vector-page-tools" data-pinned-container-id="vector-page-tools-pinned-container" data-unpinned-container-id="vector-page-tools-unpinned-container" > <div class="vector-pinnable-header-label">Tools</div> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-pin-button" data-event-name="pinnable-header.vector-page-tools.pin">move to sidebar</button> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-unpin-button" data-event-name="pinnable-header.vector-page-tools.unpin">hide</button> </div> <div id="p-cactions" class="vector-menu mw-portlet mw-portlet-cactions emptyPortlet vector-has-collapsible-items" title="More options" > <div class="vector-menu-heading"> Actions </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="ca-more-view" class="selected vector-more-collapsible-item mw-list-item"><a href="/wiki/Control-flow_integrity"><span>Read</span></a></li><li id="ca-more-edit" class="vector-more-collapsible-item mw-list-item"><a href="/w/index.php?title=Control-flow_integrity&action=edit" title="Edit this page [e]" accesskey="e"><span>Edit</span></a></li><li id="ca-more-history" class="vector-more-collapsible-item mw-list-item"><a href="/w/index.php?title=Control-flow_integrity&action=history"><span>View history</span></a></li> </ul> </div> </div> <div id="p-tb" class="vector-menu mw-portlet mw-portlet-tb" > <div class="vector-menu-heading"> General </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="t-whatlinkshere" class="mw-list-item"><a href="/wiki/Special:WhatLinksHere/Control-flow_integrity" title="List of all English Wikipedia pages containing links to this page [j]" accesskey="j"><span>What links here</span></a></li><li id="t-recentchangeslinked" class="mw-list-item"><a href="/wiki/Special:RecentChangesLinked/Control-flow_integrity" rel="nofollow" title="Recent changes in pages linked from this page [k]" accesskey="k"><span>Related changes</span></a></li><li id="t-upload" class="mw-list-item"><a href="/wiki/Wikipedia:File_Upload_Wizard" title="Upload files [u]" accesskey="u"><span>Upload file</span></a></li><li id="t-specialpages" class="mw-list-item"><a href="/wiki/Special:SpecialPages" title="A list of all special pages [q]" accesskey="q"><span>Special pages</span></a></li><li id="t-permalink" class="mw-list-item"><a href="/w/index.php?title=Control-flow_integrity&oldid=1252464912" title="Permanent link to this revision of this page"><span>Permanent link</span></a></li><li id="t-info" class="mw-list-item"><a href="/w/index.php?title=Control-flow_integrity&action=info" title="More information about this page"><span>Page information</span></a></li><li id="t-cite" class="mw-list-item"><a href="/w/index.php?title=Special:CiteThisPage&page=Control-flow_integrity&id=1252464912&wpFormIdentifier=titleform" title="Information on how to cite this page"><span>Cite this page</span></a></li><li id="t-urlshortener" class="mw-list-item"><a href="/w/index.php?title=Special:UrlShortener&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FControl-flow_integrity"><span>Get shortened URL</span></a></li><li id="t-urlshortener-qrcode" class="mw-list-item"><a href="/w/index.php?title=Special:QrCode&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FControl-flow_integrity"><span>Download QR code</span></a></li> </ul> </div> </div> <div id="p-coll-print_export" class="vector-menu mw-portlet mw-portlet-coll-print_export" > <div class="vector-menu-heading"> Print/export </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="coll-download-as-rl" class="mw-list-item"><a href="/w/index.php?title=Special:DownloadAsPdf&page=Control-flow_integrity&action=show-download-screen" title="Download this page as a PDF file"><span>Download as PDF</span></a></li><li id="t-print" class="mw-list-item"><a href="/w/index.php?title=Control-flow_integrity&printable=yes" title="Printable version of this page [p]" accesskey="p"><span>Printable version</span></a></li> </ul> </div> </div> <div id="p-wikibase-otherprojects" class="vector-menu mw-portlet mw-portlet-wikibase-otherprojects" > <div class="vector-menu-heading"> In other projects </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="t-wikibase" class="wb-otherproject-link wb-otherproject-wikibase-dataitem mw-list-item"><a href="https://www.wikidata.org/wiki/Special:EntityPage/Q27627868" title="Structured data on this page hosted by Wikidata [g]" accesskey="g"><span>Wikidata item</span></a></li> </ul> </div> </div> </div> </div> </div> </div> </nav> </div> </div> </div> <div class="vector-column-end"> <div class="vector-sticky-pinned-container"> <nav class="vector-page-tools-landmark" aria-label="Page tools"> <div id="vector-page-tools-pinned-container" class="vector-pinned-container"> </div> </nav> <nav class="vector-appearance-landmark" aria-label="Appearance"> <div id="vector-appearance-pinned-container" class="vector-pinned-container"> <div id="vector-appearance" class="vector-appearance vector-pinnable-element"> <div class="vector-pinnable-header vector-appearance-pinnable-header vector-pinnable-header-pinned" data-feature-name="appearance-pinned" data-pinnable-element-id="vector-appearance" data-pinned-container-id="vector-appearance-pinned-container" data-unpinned-container-id="vector-appearance-unpinned-container" > <div class="vector-pinnable-header-label">Appearance</div> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-pin-button" data-event-name="pinnable-header.vector-appearance.pin">move to sidebar</button> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-unpin-button" data-event-name="pinnable-header.vector-appearance.unpin">hide</button> </div> </div> </div> </nav> </div> </div> <div id="bodyContent" class="vector-body" aria-labelledby="firstHeading" data-mw-ve-target-container> <div class="vector-body-before-content"> <div class="mw-indicators"> </div> <div id="siteSub" class="noprint">From Wikipedia, the free encyclopedia</div> </div> <div id="contentSub"><div id="mw-content-subtitle"></div></div> <div id="mw-content-text" class="mw-body-content"><div class="mw-content-ltr mw-parser-output" lang="en" dir="ltr"><style data-mw-deduplicate="TemplateStyles:r1236090951">.mw-parser-output .hatnote{font-style:italic}.mw-parser-output div.hatnote{padding-left:1.6em;margin-bottom:0.5em}.mw-parser-output .hatnote i{font-style:normal}.mw-parser-output .hatnote+link+.hatnote{margin-top:-0.5em}@media print{body.ns-0 .mw-parser-output .hatnote{display:none!important}}</style><div role="note" class="hatnote navigation-not-searchable">Not to be confused with <a href="/wiki/Common_Flash_Interface" class="mw-redirect" title="Common Flash Interface">Common Flash Interface</a>, the flash memory device identification standard.</div> <div class="shortdescription nomobile noexcerpt noprint searchaux" style="display:none">Term in computer security</div> <p><b>Control-flow integrity</b> (<b>CFI</b>) is a general term for <a href="/wiki/Computer_security" title="Computer security">computer security</a> techniques that prevent a wide variety of <a href="/wiki/Malware" title="Malware">malware</a> attacks from redirecting the flow of execution (the <a href="/wiki/Control_flow" title="Control flow">control flow</a>) of a program. </p> <meta property="mw:PageProp/toc" /> <div class="mw-heading mw-heading2"><h2 id="Background">Background</h2><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Control-flow_integrity&action=edit&section=1" title="Edit section: Background"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <p>A computer program commonly changes its control flow to make decisions and use different parts of the code. Such transfers may be <i>direct</i>, in that the target address is written in the code itself, or <i>indirect</i>, in that the target address itself is a variable in memory or a CPU register. In a typical function call, the program performs a direct call, but returns to the caller function using the stack – an indirect <i>backward-edge</i> transfer. When a <a href="/wiki/Function_pointer" title="Function pointer">function pointer</a> is called, such as from a <a href="/wiki/Virtual_table" class="mw-redirect" title="Virtual table">virtual table</a>, we say there is an indirect <i>forward-edge</i> transfer.<sup id="cite_ref-Payer_1-0" class="reference"><a href="#cite_note-Payer-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup> </p><p>Attackers seek to inject code into a program to make use of its privileges or to extract data from its memory space. Before executable code was commonly made read-only, an attacker could arbitrarily change the code as it is run, targeting direct transfers or even do with no transfers at all. After <a href="/wiki/W%5EX" title="W^X">W^X</a> became widespread, an attacker wants to instead redirect execution to a separate, unprotected area containing the code to be run, making use of indirect transfers: one could overwrite the virtual table for a forward-edge attack or change the call stack for a backward-edge attack (<a href="/wiki/Return-oriented_programming" title="Return-oriented programming">return-oriented programming</a>). CFI is designed to protect indirect transfers from going to unintended locations.<sup id="cite_ref-Payer_1-1" class="reference"><a href="#cite_note-Payer-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup> </p> <div class="mw-heading mw-heading2"><h2 id="Techniques">Techniques</h2><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Control-flow_integrity&action=edit&section=2" title="Edit section: Techniques"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <p>Associated techniques include code-pointer separation (CPS), code-pointer integrity (CPI), <a href="/wiki/Stack_canary" class="mw-redirect" title="Stack canary">stack canaries</a>, <a href="/wiki/Shadow_stack" title="Shadow stack">shadow stacks</a>, and <a href="/wiki/Virtual_method_table" title="Virtual method table">vtable</a> pointer verification.<sup id="cite_ref-cfi_vs_vps_vs_cpi_3-0" class="reference"><a href="#cite_note-cfi_vs_vps_vs_cpi-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-adobe_darkreading_4-0" class="reference"><a href="#cite_note-adobe_darkreading-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-endgame_blackhat_5-0" class="reference"><a href="#cite_note-endgame_blackhat-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup> These protections can be classified into either <i>coarse-grained</i> or <i>fine-grained</i> based on the number of targets restricted. A coarse-grained forward-edge CFI implementation, could, for example, restrict the set of indirect call targets to any function that may be indirectly called in the program, while a fine-grained one would restrict each indirect call site to functions that have the same type as the function to be called. Similarly, for a backward edge scheme protecting returns, a coarse-grained implementation would only allow the procedure to return to a function of the same type (of which there could be many, especially for common prototypes), while a fine-grained one would enforce precise return matching (so it can return only to the function that called it). </p> <div class="mw-heading mw-heading2"><h2 id="Implementations">Implementations</h2><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Control-flow_integrity&action=edit&section=3" title="Edit section: Implementations"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <p>Related implementations are available in <a href="/wiki/Clang" title="Clang">Clang</a> (LLVM in general),<sup id="cite_ref-clang_cfi_6-0" class="reference"><a href="#cite_note-clang_cfi-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup> Microsoft's Control Flow Guard<sup id="cite_ref-theregister_windows_cfg_7-0" class="reference"><a href="#cite_note-theregister_windows_cfg-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-threatpost_cfg_8-0" class="reference"><a href="#cite_note-threatpost_cfg-8"><span class="cite-bracket">[</span>8<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-derbycon_bluehat_9-0" class="reference"><a href="#cite_note-derbycon_bluehat-9"><span class="cite-bracket">[</span>9<span class="cite-bracket">]</span></a></sup> and Return Flow Guard,<sup id="cite_ref-Tencent_-_Return_Flow_Guard_10-0" class="reference"><a href="#cite_note-Tencent_-_Return_Flow_Guard-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup> Google's Indirect Function-Call Checks<sup id="cite_ref-gcc_cfi_usenix14_11-0" class="reference"><a href="#cite_note-gcc_cfi_usenix14-11"><span class="cite-bracket">[</span>11<span class="cite-bracket">]</span></a></sup> and Reuse Attack Protector (RAP).<sup id="cite_ref-pax_rap_de_12-0" class="reference"><a href="#cite_note-pax_rap_de-12"><span class="cite-bracket">[</span>12<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-grsecurity_rap_13-0" class="reference"><a href="#cite_note-grsecurity_rap-13"><span class="cite-bracket">[</span>13<span class="cite-bracket">]</span></a></sup> </p> <div class="mw-heading mw-heading3"><h3 id="LLVM/Clang"><span id="LLVM.2FClang"></span>LLVM/Clang</h3><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Control-flow_integrity&action=edit&section=4" title="Edit section: LLVM/Clang"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <style data-mw-deduplicate="TemplateStyles:r1251242444">.mw-parser-output .ambox{border:1px solid #a2a9b1;border-left:10px solid #36c;background-color:#fbfbfb;box-sizing:border-box}.mw-parser-output .ambox+link+.ambox,.mw-parser-output .ambox+link+style+.ambox,.mw-parser-output .ambox+link+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+style+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+link+.ambox{margin-top:-1px}html body.mediawiki .mw-parser-output .ambox.mbox-small-left{margin:4px 1em 4px 0;overflow:hidden;width:238px;border-collapse:collapse;font-size:88%;line-height:1.25em}.mw-parser-output .ambox-speedy{border-left:10px solid #b32424;background-color:#fee7e6}.mw-parser-output .ambox-delete{border-left:10px solid #b32424}.mw-parser-output .ambox-content{border-left:10px solid #f28500}.mw-parser-output .ambox-style{border-left:10px solid #fc3}.mw-parser-output .ambox-move{border-left:10px solid #9932cc}.mw-parser-output .ambox-protection{border-left:10px solid #a2a9b1}.mw-parser-output .ambox .mbox-text{border:none;padding:0.25em 0.5em;width:100%}.mw-parser-output .ambox .mbox-image{border:none;padding:2px 0 2px 0.5em;text-align:center}.mw-parser-output .ambox .mbox-imageright{border:none;padding:2px 0.5em 2px 0;text-align:center}.mw-parser-output .ambox .mbox-empty-cell{border:none;padding:0;width:1px}.mw-parser-output .ambox .mbox-image-div{width:52px}@media(min-width:720px){.mw-parser-output .ambox{margin:0 10%}}@media print{body.ns-0 .mw-parser-output .ambox{display:none!important}}</style><table class="box-Expand_section plainlinks metadata ambox mbox-small-left ambox-content" role="presentation"><tbody><tr><td class="mbox-image"><span typeof="mw:File"><a href="/wiki/File:Wiki_letter_w_cropped.svg" class="mw-file-description"><img alt="[icon]" src="//upload.wikimedia.org/wikipedia/commons/thumb/1/1c/Wiki_letter_w_cropped.svg/20px-Wiki_letter_w_cropped.svg.png" decoding="async" width="20" height="14" class="mw-file-element" srcset="//upload.wikimedia.org/wikipedia/commons/thumb/1/1c/Wiki_letter_w_cropped.svg/30px-Wiki_letter_w_cropped.svg.png 1.5x, //upload.wikimedia.org/wikipedia/commons/thumb/1/1c/Wiki_letter_w_cropped.svg/40px-Wiki_letter_w_cropped.svg.png 2x" data-file-width="44" data-file-height="31" /></a></span></td><td class="mbox-text"><div class="mbox-text-span">This section <b>needs expansion</b>. You can help by <a class="external text" href="https://en.wikipedia.org/w/index.php?title=Control-flow_integrity&action=edit&section=">adding to it</a>. <span class="date-container"><i>(<span class="date">September 2020</span>)</i></span></div></td></tr></tbody></table> <p>LLVM/Clang provides a "CFI" option that works in the forward edge by checking for errors in <a href="/wiki/Virtual_table" class="mw-redirect" title="Virtual table">virtual tables</a> and type casts. It depends on <a href="/wiki/Link-time_optimization" class="mw-redirect" title="Link-time optimization">link-time optimization</a> (LTO) to know what functions are supposed to be called in normal cases.<sup id="cite_ref-14" class="reference"><a href="#cite_note-14"><span class="cite-bracket">[</span>14<span class="cite-bracket">]</span></a></sup> There is a separate "<a href="/wiki/Shadow_call_stack" class="mw-redirect" title="Shadow call stack">shadow call stack</a>" scheme that defends on the backward edge by checking for call stack modifications, available only for aarch64.<sup id="cite_ref-15" class="reference"><a href="#cite_note-15"><span class="cite-bracket">[</span>15<span class="cite-bracket">]</span></a></sup> </p><p>Google has shipped <a href="/wiki/Android_(OS)" class="mw-redirect" title="Android (OS)">Android</a> with the <a href="/wiki/Linux_kernel" title="Linux kernel">Linux kernel</a> compiled by Clang with <a href="/wiki/Link-time_optimization" class="mw-redirect" title="Link-time optimization">link-time optimization</a> (LTO) and CFI since 2018.<sup id="cite_ref-16" class="reference"><a href="#cite_note-16"><span class="cite-bracket">[</span>16<span class="cite-bracket">]</span></a></sup> SCS is available for Linux kernel as an option, including on Android.<sup id="cite_ref-17" class="reference"><a href="#cite_note-17"><span class="cite-bracket">[</span>17<span class="cite-bracket">]</span></a></sup> </p> <div class="mw-heading mw-heading3"><h3 id="Intel_Control-flow_Enforcement_Technology">Intel Control-flow Enforcement Technology<span class="anchor" id="CET"></span></h3><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Control-flow_integrity&action=edit&section=5" title="Edit section: Intel Control-flow Enforcement Technology"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1251242444"><table class="box-Expand_section plainlinks metadata ambox mbox-small-left ambox-content" role="presentation"><tbody><tr><td class="mbox-image"><span typeof="mw:File"><a href="/wiki/File:Wiki_letter_w_cropped.svg" class="mw-file-description"><img alt="[icon]" src="//upload.wikimedia.org/wikipedia/commons/thumb/1/1c/Wiki_letter_w_cropped.svg/20px-Wiki_letter_w_cropped.svg.png" decoding="async" width="20" height="14" class="mw-file-element" srcset="//upload.wikimedia.org/wikipedia/commons/thumb/1/1c/Wiki_letter_w_cropped.svg/30px-Wiki_letter_w_cropped.svg.png 1.5x, //upload.wikimedia.org/wikipedia/commons/thumb/1/1c/Wiki_letter_w_cropped.svg/40px-Wiki_letter_w_cropped.svg.png 2x" data-file-width="44" data-file-height="31" /></a></span></td><td class="mbox-text"><div class="mbox-text-span">This section <b>needs expansion</b>. You can help by <a class="external text" href="https://en.wikipedia.org/w/index.php?title=Control-flow_integrity&action=edit&section=">adding to it</a>. <span class="date-container"><i>(<span class="date">January 2021</span>)</i></span></div></td></tr></tbody></table> <p>Intel Control-flow Enforcement Technology (CET) detects compromises to control flow integrity with a <a href="/wiki/Shadow_stack" title="Shadow stack">shadow stack</a> (SS) and <a href="/wiki/Indirect_branch_tracking" title="Indirect branch tracking">indirect branch tracking</a> (IBT).<sup id="cite_ref-Control-flow_Enforcement_Technology_Specification_18-0" class="reference"><a href="#cite_note-Control-flow_Enforcement_Technology_Specification-18"><span class="cite-bracket">[</span>18<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-R.I.P_ROP:_CET_Internals_in_Windows_20H1_19-0" class="reference"><a href="#cite_note-R.I.P_ROP:_CET_Internals_in_Windows_20H1-19"><span class="cite-bracket">[</span>19<span class="cite-bracket">]</span></a></sup> </p><p>The kernel must map a region of memory for the shadow stack not writable to user space programs except by special instructions. The shadow stack stores a copy of the return address of each CALL. On a RET, the processor checks if the return address stored in the normal stack and shadow stack are equal. If the addresses are not equal, the processor generates an INT #21 (Control Flow Protection Fault). </p><p>Indirect branch tracking detects indirect JMP or CALL instructions to unauthorized targets. It is implemented by adding a new internal state machine in the processor. The behavior of indirect JMP and CALL instructions is changed so that they switch the state machine from IDLE to WAIT_FOR_ENDBRANCH. In the WAIT_FOR_ENDBRANCH state, the next instruction to be executed is required to be the new ENDBRANCH instruction (ENDBR32 in 32-bit mode or ENDBR64 in 64-bit mode), which changes the internal state machine from WAIT_FOR_ENDBRANCH back to IDLE. Thus every authorized target of an indirect JMP or CALL must begin with ENDBRANCH. If the processor is in a WAIT_FOR_ENDBRANCH state (meaning, the previous instruction was an indirect JMP or CALL), and the next instruction is not an ENDBRANCH instruction, the processor generates an INT #21 (Control Flow Protection Fault). On processors not supporting CET indirect branch tracking, ENDBRANCH instructions are interpreted as NOPs and have no effect. </p> <div class="mw-heading mw-heading3"><h3 id="Microsoft_Control_Flow_Guard">Microsoft Control Flow Guard</h3><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Control-flow_integrity&action=edit&section=6" title="Edit section: Microsoft Control Flow Guard"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <p>Control Flow Guard (CFG) was first released for <a href="/wiki/Windows_8.1" title="Windows 8.1">Windows 8.1</a> Update 3 (KB3000850) in November 2014. Developers can add CFG to their programs by adding the <code>/guard:cf</code> linker flag before program linking in Visual Studio 2015 or newer.<sup id="cite_ref-MSDN_-_Control_Flow_Guard_20-0" class="reference"><a href="#cite_note-MSDN_-_Control_Flow_Guard-20"><span class="cite-bracket">[</span>20<span class="cite-bracket">]</span></a></sup> </p><p>As of <a href="/wiki/Windows_10_Creators_Update" class="mw-redirect" title="Windows 10 Creators Update">Windows 10 Creators Update</a> (Windows 10 version 1703), the Windows kernel is compiled with CFG.<sup id="cite_ref-TechNet_-_Shadow_Brokers_21-0" class="reference"><a href="#cite_note-TechNet_-_Shadow_Brokers-21"><span class="cite-bracket">[</span>21<span class="cite-bracket">]</span></a></sup> The Windows kernel uses <a href="/wiki/Hyper-V" title="Hyper-V">Hyper-V</a> to prevent malicious kernel code from overwriting the CFG bitmap.<sup id="cite_ref-Ionescu_-_Universally_Bypassing_CFG_Through_Mutability_Abuse_22-0" class="reference"><a href="#cite_note-Ionescu_-_Universally_Bypassing_CFG_Through_Mutability_Abuse-22"><span class="cite-bracket">[</span>22<span class="cite-bracket">]</span></a></sup> </p><p>CFG operates by creating a per-process <a href="/wiki/Bitmap" title="Bitmap">bitmap</a>, where a set bit indicates that the address is a valid destination. Before performing each indirect function call, the application checks if the destination address is in the bitmap. If the destination address is not in the bitmap, the program terminates.<sup id="cite_ref-MSDN_-_Control_Flow_Guard_20-1" class="reference"><a href="#cite_note-MSDN_-_Control_Flow_Guard-20"><span class="cite-bracket">[</span>20<span class="cite-bracket">]</span></a></sup> This makes it more difficult for an attacker to exploit a <a href="/wiki/Use-after-free" class="mw-redirect" title="Use-after-free">use-after-free</a> by replacing an object's contents and then using an indirect function call to execute a payload.<sup id="cite_ref-Exploiting_CVE-2015-0311,_Part_II_23-0" class="reference"><a href="#cite_note-Exploiting_CVE-2015-0311,_Part_II-23"><span class="cite-bracket">[</span>23<span class="cite-bracket">]</span></a></sup> </p> <div class="mw-heading mw-heading4"><h4 id="Implementation_details">Implementation details</h4><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Control-flow_integrity&action=edit&section=7" title="Edit section: Implementation details"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <p>For all protected indirect function calls, the <code> _guard_check_icall</code> function is called, which performs the following steps:<sup id="cite_ref-Exploring_Control_Flow_Guard_in_Windows_10_24-0" class="reference"><a href="#cite_note-Exploring_Control_Flow_Guard_in_Windows_10-24"><span class="cite-bracket">[</span>24<span class="cite-bracket">]</span></a></sup> </p> <ol><li>Convert the target address to an offset and bit number in the bitmap. <ol><li>The highest 3 bytes are the byte offset in the bitmap</li> <li>The bit offset is a 5-bit value. The first four bits are the 4th through 8th low-order bits of the address.</li> <li>The 5th bit of the bit offset is set to 0 if the destination address is aligned with 0x10 (last four bits are 0), and 1 if it is not.</li></ol></li> <li>Examine the target's address value in the bitmap <ol><li>If the target address is in the bitmap, return without an error.</li> <li>If the target address is not in the bitmap, terminate the program.</li></ol></li></ol> <div class="mw-heading mw-heading4"><h4 id="Bypass_techniques">Bypass techniques</h4><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Control-flow_integrity&action=edit&section=8" title="Edit section: Bypass techniques"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <p>There are several generic techniques for bypassing CFG: </p> <ul><li>Set the destination to code located in a non-CFG module loaded in the same process.<sup id="cite_ref-Exploiting_CVE-2015-0311,_Part_II_23-1" class="reference"><a href="#cite_note-Exploiting_CVE-2015-0311,_Part_II-23"><span class="cite-bracket">[</span>23<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-Windows_10_Control_Flow_Guard_Internals_25-0" class="reference"><a href="#cite_note-Windows_10_Control_Flow_Guard_Internals-25"><span class="cite-bracket">[</span>25<span class="cite-bracket">]</span></a></sup></li> <li>Find an indirect call that was not protected by CFG (either CALL or JMP).<sup id="cite_ref-Exploiting_CVE-2015-0311,_Part_II_23-2" class="reference"><a href="#cite_note-Exploiting_CVE-2015-0311,_Part_II-23"><span class="cite-bracket">[</span>23<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-Windows_10_Control_Flow_Guard_Internals_25-1" class="reference"><a href="#cite_note-Windows_10_Control_Flow_Guard_Internals-25"><span class="cite-bracket">[</span>25<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-BYPASS_CONTROL_FLOW_GUARD_COMPREHENSIVELY_26-0" class="reference"><a href="#cite_note-BYPASS_CONTROL_FLOW_GUARD_COMPREHENSIVELY-26"><span class="cite-bracket">[</span>26<span class="cite-bracket">]</span></a></sup></li> <li>Use a function call with a different number of arguments than the call is designed for, causing a stack misalignment, and code execution after the function returns (patched in Windows 10).<sup id="cite_ref-Bromium_CFG_stack_desync_27-0" class="reference"><a href="#cite_note-Bromium_CFG_stack_desync-27"><span class="cite-bracket">[</span>27<span class="cite-bracket">]</span></a></sup></li> <li>Use a function call with the same number of arguments, but one of pointers passed is treated as an object and writes to a pointer-based offset, allowing overwriting a return address.<sup id="cite_ref-Object_Oriented_Exploitation:_New_techniques_in_Windows_mitigation_bypass_28-0" class="reference"><a href="#cite_note-Object_Oriented_Exploitation:_New_techniques_in_Windows_mitigation_bypass-28"><span class="cite-bracket">[</span>28<span class="cite-bracket">]</span></a></sup></li> <li>Overwrite the function call used by the CFG to validate the address (patched in March 2015)<sup id="cite_ref-BYPASS_CONTROL_FLOW_GUARD_COMPREHENSIVELY_26-1" class="reference"><a href="#cite_note-BYPASS_CONTROL_FLOW_GUARD_COMPREHENSIVELY-26"><span class="cite-bracket">[</span>26<span class="cite-bracket">]</span></a></sup></li> <li>Set the CFG bitmap to all 1's, allowing all indirect function calls<sup id="cite_ref-BYPASS_CONTROL_FLOW_GUARD_COMPREHENSIVELY_26-2" class="reference"><a href="#cite_note-BYPASS_CONTROL_FLOW_GUARD_COMPREHENSIVELY-26"><span class="cite-bracket">[</span>26<span class="cite-bracket">]</span></a></sup></li> <li>Use a controlled-write primitive to overwrite an address on the stack (since the stack is not protected by CFG) <sup id="cite_ref-BYPASS_CONTROL_FLOW_GUARD_COMPREHENSIVELY_26-3" class="reference"><a href="#cite_note-BYPASS_CONTROL_FLOW_GUARD_COMPREHENSIVELY-26"><span class="cite-bracket">[</span>26<span class="cite-bracket">]</span></a></sup></li></ul> <div class="mw-heading mw-heading3"><h3 id="Microsoft_eXtended_Flow_Guard">Microsoft eXtended Flow Guard</h3><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Control-flow_integrity&action=edit&section=9" title="Edit section: Microsoft eXtended Flow Guard"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <p>eXtended Flow Guard (XFG) has not been officially released yet, but is available in the Windows Insider preview and was publicly presented at Bluehat Shanghai in 2019.<sup id="cite_ref-Advancing_Windows_Security_Bluehat_Shanghai_2019_29-0" class="reference"><a href="#cite_note-Advancing_Windows_Security_Bluehat_Shanghai_2019-29"><span class="cite-bracket">[</span>29<span class="cite-bracket">]</span></a></sup> </p><p>XFG extends CFG by validating function call signatures to ensure that indirect function calls are only to the subset of functions with the same signature. Function call signature validation is implemented by adding instructions to store the target function's hash in register r10 immediately prior to the indirect call and storing the calculated function hash in the memory immediately preceding the target address's code. When the indirect call is made, the XFG validation function compares the value in r10 to the target function's stored hash. <sup id="cite_ref-EXTENDED_FLOW_GUARD_UNDER_THE_MICROSCOPE_30-0" class="reference"><a href="#cite_note-EXTENDED_FLOW_GUARD_UNDER_THE_MICROSCOPE-30"><span class="cite-bracket">[</span>30<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-Exploit_Development:_Between_a_Rock_and_a_(Xtended_Flow)_Guard_Place:_Examining_XFG_31-0" class="reference"><a href="#cite_note-Exploit_Development:_Between_a_Rock_and_a_(Xtended_Flow)_Guard_Place:_Examining_XFG-31"><span class="cite-bracket">[</span>31<span class="cite-bracket">]</span></a></sup> </p> <div class="mw-heading mw-heading2"><h2 id="See_also">See also</h2><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Control-flow_integrity&action=edit&section=10" title="Edit section: See also"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <ul><li><a href="/wiki/Buffer_overflow_protection" title="Buffer overflow protection">Buffer overflow protection</a></li></ul> <div class="mw-heading mw-heading2"><h2 id="References">References</h2><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=Control-flow_integrity&action=edit&section=11" title="Edit section: References"><span>edit</span></a><span class="mw-editsection-bracket">]</span></span></div> <style data-mw-deduplicate="TemplateStyles:r1239543626">.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}</style><div class="reflist"> <div class="mw-references-wrap mw-references-columns"><ol class="references"> <li id="cite_note-Payer-1"><span class="mw-cite-backlink">^ <a href="#cite_ref-Payer_1-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-Payer_1-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><style data-mw-deduplicate="TemplateStyles:r1238218222">.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("//upload.wikimedia.org/wikipedia/commons/6/65/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("//upload.wikimedia.org/wikipedia/commons/d/d6/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("//upload.wikimedia.org/wikipedia/commons/a/aa/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("//upload.wikimedia.org/wikipedia/commons/4/4c/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}</style><cite id="CITEREFPayer" class="citation web cs1">Payer, Mattias. <a rel="nofollow" class="external text" href="https://nebelwelt.net/blog/20160913-ControlFlowIntegrity.html">"Control-Flow Integrity: An Introduction"</a>. <i>nebelwelt.net</i>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=nebelwelt.net&rft.atitle=Control-Flow+Integrity%3A+An+Introduction&rft.aulast=Payer&rft.aufirst=Mattias&rft_id=https%3A%2F%2Fnebelwelt.net%2Fblog%2F20160913-ControlFlowIntegrity.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFBurowCarrNashLarsen2018" class="citation journal cs1">Burow, Nathan; Carr, Scott A.; Nash, Joseph; Larsen, Per; Franz, Michael; Brunthaler, Stefan; Payer, Mathias (31 January 2018). <a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F3054924">"Control-Flow Integrity: Precision, Security, and Performance"</a>. <i>ACM Computing Surveys</i>. <b>50</b> (1): 1–33. <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<span class="id-lock-free" title="Freely accessible"><a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F3054924">10.1145/3054924</a></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=ACM+Computing+Surveys&rft.atitle=Control-Flow+Integrity%3A+Precision%2C+Security%2C+and+Performance&rft.volume=50&rft.issue=1&rft.pages=1-33&rft.date=2018-01-31&rft_id=info%3Adoi%2F10.1145%2F3054924&rft.aulast=Burow&rft.aufirst=Nathan&rft.au=Carr%2C+Scott+A.&rft.au=Nash%2C+Joseph&rft.au=Larsen%2C+Per&rft.au=Franz%2C+Michael&rft.au=Brunthaler%2C+Stefan&rft.au=Payer%2C+Mathias&rft_id=https%3A%2F%2Fdoi.org%2F10.1145%252F3054924&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-cfi_vs_vps_vs_cpi-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-cfi_vs_vps_vs_cpi_3-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFPayerKuznetsov" class="citation web cs1"><a href="/wiki/Mathias_Payer" title="Mathias Payer">Payer, Mathias</a>; Kuznetsov, Volodymyr. <a rel="nofollow" class="external text" href="https://nebelwelt.net/blog/20141007-CFICPSCPIdiffs.html">"On differences between the CFI, CPS, and CPI properties"</a>. <i>nebelwelt.net</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2016-06-01</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=nebelwelt.net&rft.atitle=On+differences+between+the+CFI%2C+CPS%2C+and+CPI+properties&rft.aulast=Payer&rft.aufirst=Mathias&rft.au=Kuznetsov%2C+Volodymyr&rft_id=https%3A%2F%2Fnebelwelt.net%2Fblog%2F20141007-CFICPSCPIdiffs.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-adobe_darkreading-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-adobe_darkreading_4-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://www.darkreading.com/vulnerabilities---threats/adobe-flash-bug-discovery-leads-to-new-attack-mitigation-method/d/d-id/1323092">"Adobe Flash Bug Discovery Leads To New Attack Mitigation Method"</a>. <i>Dark Reading</i>. 10 November 2015<span class="reference-accessdate">. Retrieved <span class="nowrap">2016-06-01</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Dark+Reading&rft.atitle=Adobe+Flash+Bug+Discovery+Leads+To+New+Attack+Mitigation+Method&rft.date=2015-11-10&rft_id=http%3A%2F%2Fwww.darkreading.com%2Fvulnerabilities---threats%2Fadobe-flash-bug-discovery-leads-to-new-attack-mitigation-method%2Fd%2Fd-id%2F1323092&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-endgame_blackhat-5"><span class="mw-cite-backlink"><b><a href="#cite_ref-endgame_blackhat_5-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFEndgame" class="citation pressrelease cs1">Endgame. <a rel="nofollow" class="external text" href="http://www.prnewswire.com/news-releases/endgame-to-present-at-black-hat-usa-2016-300267060.html">"Endgame to Present at Black Hat USA 2016"</a>. <i>www.prnewswire.com</i> (Press release)<span class="reference-accessdate">. Retrieved <span class="nowrap">2016-06-01</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Endgame+to+Present+at+Black+Hat+USA+2016&rft.au=Endgame&rft_id=http%3A%2F%2Fwww.prnewswire.com%2Fnews-releases%2Fendgame-to-present-at-black-hat-usa-2016-300267060.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-clang_cfi-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-clang_cfi_6-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://clang.llvm.org/docs/ControlFlowIntegrity.html">"Control Flow Integrity — Clang 3.9 documentation"</a>. <i>clang.llvm.org</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2016-06-01</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=clang.llvm.org&rft.atitle=Control+Flow+Integrity+%E2%80%94+Clang+3.9+documentation&rft_id=http%3A%2F%2Fclang.llvm.org%2Fdocs%2FControlFlowIntegrity.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-theregister_windows_cfg-7"><span class="mw-cite-backlink"><b><a href="#cite_ref-theregister_windows_cfg_7-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFPauli" class="citation web cs1">Pauli, Darren. <a rel="nofollow" class="external text" href="https://www.theregister.co.uk/2016/02/04/emets_win_10_revival_could_be_its_last_as_os_bakes_into_infosec/">"Microsoft's malware mitigator refreshed, but even Redmond says it's no longer needed"</a>. <i><a href="/wiki/The_Register" title="The Register">The Register</a></i><span class="reference-accessdate">. Retrieved <span class="nowrap">2016-06-01</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=The+Register&rft.atitle=Microsoft%27s+malware+mitigator+refreshed%2C+but+even+Redmond+says+it%27s+no+longer+needed&rft.aulast=Pauli&rft.aufirst=Darren&rft_id=https%3A%2F%2Fwww.theregister.co.uk%2F2016%2F02%2F04%2Femets_win_10_revival_could_be_its_last_as_os_bakes_into_infosec%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-threatpost_cfg-8"><span class="mw-cite-backlink"><b><a href="#cite_ref-threatpost_cfg_8-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFMimoso2015" class="citation web cs1">Mimoso, Michael (2015-09-22). <a rel="nofollow" class="external text" href="https://threatpost.com/bypass-developed-for-microsoft-memory-protection-control-flow-guard/114768/">"Bypass Developed for Microsoft Memory Protection, Control Flow Guard"</a>. <i>Threatpost | The first stop for security news</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2016-06-01</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Threatpost+%7C+The+first+stop+for+security+news&rft.atitle=Bypass+Developed+for+Microsoft+Memory+Protection%2C+Control+Flow+Guard&rft.date=2015-09-22&rft.aulast=Mimoso&rft.aufirst=Michael&rft_id=https%3A%2F%2Fthreatpost.com%2Fbypass-developed-for-microsoft-memory-protection-control-flow-guard%2F114768%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-derbycon_bluehat-9"><span class="mw-cite-backlink"><b><a href="#cite_ref-derbycon_bluehat_9-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFSmith2015" class="citation web cs1">Smith, Ms. (23 September 2015). <a rel="nofollow" class="external text" href="https://web.archive.org/web/20150927052810/http://www.networkworld.com/article/2985686/microsoft-subnet/derbycon-former-bluehat-prize-winner-will-bypass-control-flow-guard-in-windows-10.html">"DerbyCon: Former BlueHat prize winner will bypass Control Flow Guard in Windows 10"</a>. <i>Network World</i>. Archived from <a rel="nofollow" class="external text" href="http://www.networkworld.com/article/2985686/microsoft-subnet/derbycon-former-bluehat-prize-winner-will-bypass-control-flow-guard-in-windows-10.html">the original</a> on September 27, 2015<span class="reference-accessdate">. Retrieved <span class="nowrap">2016-06-01</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Network+World&rft.atitle=DerbyCon%3A+Former+BlueHat+prize+winner+will+bypass+Control+Flow+Guard+in+Windows+10&rft.date=2015-09-23&rft.aulast=Smith&rft.aufirst=Ms.&rft_id=http%3A%2F%2Fwww.networkworld.com%2Farticle%2F2985686%2Fmicrosoft-subnet%2Fderbycon-former-bluehat-prize-winner-will-bypass-control-flow-guard-in-windows-10.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-Tencent_-_Return_Flow_Guard-10"><span class="mw-cite-backlink"><b><a href="#cite_ref-Tencent_-_Return_Flow_Guard_10-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://xlab.tencent.com/en/2016/11/02/return-flow-guard/">"Return Flow Guard"</a>. <i>Tencent</i>. 2 November 2016<span class="reference-accessdate">. Retrieved <span class="nowrap">2017-01-19</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Tencent&rft.atitle=Return+Flow+Guard&rft.date=2016-11-02&rft_id=http%3A%2F%2Fxlab.tencent.com%2Fen%2F2016%2F11%2F02%2Freturn-flow-guard%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-gcc_cfi_usenix14-11"><span class="mw-cite-backlink"><b><a href="#cite_ref-gcc_cfi_usenix14_11-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFTiceRoederCollingbourneCheckoway2014" class="citation book cs1">Tice, Caroline; Roeder, Tom; Collingbourne, Peter; Checkoway, Stephen; Erlingsson, Úlfar; Lozano, Luis; Pike, Geoff (2014-01-01). <a rel="nofollow" class="external text" href="https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/tice"><i>Enforcing Forward-Edge Control-Flow Integrity in GCC & LLVM</i></a>. pp. 941–955. <a href="/wiki/ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <a href="/wiki/Special:BookSources/9781931971157" title="Special:BookSources/9781931971157"><bdi>9781931971157</bdi></a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=book&rft.btitle=Enforcing+Forward-Edge+Control-Flow+Integrity+in+GCC+%26+LLVM&rft.pages=941-955&rft.date=2014-01-01&rft.isbn=9781931971157&rft.aulast=Tice&rft.aufirst=Caroline&rft.au=Roeder%2C+Tom&rft.au=Collingbourne%2C+Peter&rft.au=Checkoway%2C+Stephen&rft.au=Erlingsson%2C+%C3%9Alfar&rft.au=Lozano%2C+Luis&rft.au=Pike%2C+Geoff&rft_id=https%3A%2F%2Fwww.usenix.org%2Fconference%2Fusenixsecurity14%2Ftechnical-sessions%2Fpresentation%2Ftice&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-pax_rap_de-12"><span class="mw-cite-backlink"><b><a href="#cite_ref-pax_rap_de_12-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFSecurity2016" class="citation web cs1 cs1-prop-foreign-lang-source">Security, heise (4 May 2016). <a rel="nofollow" class="external text" href="http://www.heise.de/security/meldung/PaX-Team-stellt-Schutz-vor-Code-Reuse-Exploits-vor-3197262.html">"PaX Team stellt Schutz vor Code Reuse Exploits vor"</a>. <i>Security</i> (in German)<span class="reference-accessdate">. Retrieved <span class="nowrap">2016-06-01</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Security&rft.atitle=PaX+Team+stellt+Schutz+vor+Code+Reuse+Exploits+vor&rft.date=2016-05-04&rft.aulast=Security&rft.aufirst=heise&rft_id=http%3A%2F%2Fwww.heise.de%2Fsecurity%2Fmeldung%2FPaX-Team-stellt-Schutz-vor-Code-Reuse-Exploits-vor-3197262.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-grsecurity_rap-13"><span class="mw-cite-backlink"><b><a href="#cite_ref-grsecurity_rap_13-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation news cs1"><a rel="nofollow" class="external text" href="https://grsecurity.net/rap_faq.php">"Frequently Asked Questions About RAP"</a><span class="reference-accessdate">. Retrieved <span class="nowrap">2016-06-01</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.atitle=Frequently+Asked+Questions+About+RAP&rft_id=https%3A%2F%2Fgrsecurity.net%2Frap_faq.php&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-14"><span class="mw-cite-backlink"><b><a href="#cite_ref-14">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://clang.llvm.org/docs/ControlFlowIntegrity.html">"Control Flow Integrity — Clang 17.0.0git documentation"</a>. <i>clang.llvm.org</i>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=clang.llvm.org&rft.atitle=Control+Flow+Integrity+%E2%80%94+Clang+17.0.0git+documentation&rft_id=https%3A%2F%2Fclang.llvm.org%2Fdocs%2FControlFlowIntegrity.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-15"><span class="mw-cite-backlink"><b><a href="#cite_ref-15">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://clang.llvm.org/docs/ShadowCallStack.html">"ShadowCallStack — Clang 17.0.0git documentation"</a>. <i>clang.llvm.org</i>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=clang.llvm.org&rft.atitle=ShadowCallStack+%E2%80%94+Clang+17.0.0git+documentation&rft_id=https%3A%2F%2Fclang.llvm.org%2Fdocs%2FShadowCallStack.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-16"><span class="mw-cite-backlink"><b><a href="#cite_ref-16">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.phoronix.com/scan.php?page=news_item&px=Clang-LTO-Linux-Kernel-V2">"Clang LTO Patches Updated for the Linux Kernel - Phoronix"</a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Clang+LTO+Patches+Updated+for+the+Linux+Kernel+-+Phoronix&rft_id=https%3A%2F%2Fwww.phoronix.com%2Fscan.php%3Fpage%3Dnews_item%26px%3DClang-LTO-Linux-Kernel-V2&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-17"><span class="mw-cite-backlink"><b><a href="#cite_ref-17">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://source.android.com/docs/security/test/shadow-call-stack">"ShadowCallStack"</a>. <i>Android Open Source Project</i>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Android+Open+Source+Project&rft.atitle=ShadowCallStack&rft_id=https%3A%2F%2Fsource.android.com%2Fdocs%2Fsecurity%2Ftest%2Fshadow-call-stack&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-Control-flow_Enforcement_Technology_Specification-18"><span class="mw-cite-backlink"><b><a href="#cite_ref-Control-flow_Enforcement_Technology_Specification_18-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20170814120442/https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf">"Control-flow Enforcement Technology Specification"</a> <span class="cs1-format">(PDF)</span>. <i>Intel Developer Zone</i>. Archived from <a rel="nofollow" class="external text" href="https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf">the original</a> <span class="cs1-format">(PDF)</span> on 2017-08-14<span class="reference-accessdate">. Retrieved <span class="nowrap">2021-01-05</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Intel+Developer+Zone&rft.atitle=Control-flow+Enforcement+Technology+Specification&rft_id=https%3A%2F%2Fsoftware.intel.com%2Fsites%2Fdefault%2Ffiles%2Fmanaged%2F4d%2F2a%2Fcontrol-flow-enforcement-technology-preview.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-R.I.P_ROP:_CET_Internals_in_Windows_20H1-19"><span class="mw-cite-backlink"><b><a href="#cite_ref-R.I.P_ROP:_CET_Internals_in_Windows_20H1_19-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://windows-internals.com/cet-on-windows/">"R.I.P ROP: CET Internals in Windows 20H1"</a>. <i>Winsider Seminars & Solutions Inc</i>. 5 January 2020<span class="reference-accessdate">. Retrieved <span class="nowrap">2021-01-05</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Winsider+Seminars+%26+Solutions+Inc.&rft.atitle=R.I.P+ROP%3A+CET+Internals+in+Windows+20H1&rft.date=2020-01-05&rft_id=https%3A%2F%2Fwindows-internals.com%2Fcet-on-windows%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-MSDN_-_Control_Flow_Guard-20"><span class="mw-cite-backlink">^ <a href="#cite_ref-MSDN_-_Control_Flow_Guard_20-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-MSDN_-_Control_Flow_Guard_20-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://msdn.microsoft.com/en-us/library/windows/desktop/mt637065(v=vs.85).aspx">"Control Flow Guard"</a>. <i>MSDN</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2017-01-19</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=MSDN&rft.atitle=Control+Flow+Guard&rft_id=https%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Fwindows%2Fdesktop%2Fmt637065%28v%3Dvs.85%29.aspx&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-TechNet_-_Shadow_Brokers-21"><span class="mw-cite-backlink"><b><a href="#cite_ref-TechNet_-_Shadow_Brokers_21-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://blogs.technet.microsoft.com/mmpc/2017/06/16/analysis-of-the-shadow-brokers-release-and-mitigation-with-windows-10-virtualization-based-security/">"Analysis of the Shadow Brokers release and mitigation with Windows 10 virtualization-based security"</a>. <i>Microsoft Technet</i>. 16 June 2017<span class="reference-accessdate">. Retrieved <span class="nowrap">2017-06-20</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Microsoft+Technet&rft.atitle=Analysis+of+the+Shadow+Brokers+release+and+mitigation+with+Windows+10+virtualization-based+security&rft.date=2017-06-16&rft_id=https%3A%2F%2Fblogs.technet.microsoft.com%2Fmmpc%2F2017%2F06%2F16%2Fanalysis-of-the-shadow-brokers-release-and-mitigation-with-windows-10-virtualization-based-security%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-Ionescu_-_Universally_Bypassing_CFG_Through_Mutability_Abuse-22"><span class="mw-cite-backlink"><b><a href="#cite_ref-Ionescu_-_Universally_Bypassing_CFG_Through_Mutability_Abuse_22-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://alex-ionescu.com/publications/euskalhack/euskalhack2017-cfg.pdf">"Universally Bypassing CFG Through Mutability Abuse"</a> <span class="cs1-format">(PDF)</span>. <i>Alex Ionescu's Blog</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2017-07-07</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Alex+Ionescu%27s+Blog&rft.atitle=Universally+Bypassing+CFG+Through+Mutability+Abuse&rft_id=http%3A%2F%2Falex-ionescu.com%2Fpublications%2Feuskalhack%2Feuskalhack2017-cfg.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-Exploiting_CVE-2015-0311,_Part_II-23"><span class="mw-cite-backlink">^ <a href="#cite_ref-Exploiting_CVE-2015-0311,_Part_II_23-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-Exploiting_CVE-2015-0311,_Part_II_23-1"><sup><i><b>b</b></i></sup></a> <a href="#cite_ref-Exploiting_CVE-2015-0311,_Part_II_23-2"><sup><i><b>c</b></i></sup></a></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFFalcón2015" class="citation web cs1">Falcón, Francisco (2015-03-25). <a rel="nofollow" class="external text" href="https://www.coresecurity.com/blog/exploiting-cve-2015-0311-part-ii-bypassing-control-flow-guard-on-windows-8-1-update-3">"Exploiting CVE-2015-0311, Part II: Bypassing Control Flow Guard on Windows 8.1 Update 3"</a>. <i>Core Security</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2017-01-19</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Core+Security&rft.atitle=Exploiting+CVE-2015-0311%2C+Part+II%3A+Bypassing+Control+Flow+Guard+on+Windows+8.1+Update+3&rft.date=2015-03-25&rft.aulast=Falc%C3%B3n&rft.aufirst=Francisco&rft_id=https%3A%2F%2Fwww.coresecurity.com%2Fblog%2Fexploiting-cve-2015-0311-part-ii-bypassing-control-flow-guard-on-windows-8-1-update-3&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-Exploring_Control_Flow_Guard_in_Windows_10-24"><span class="mw-cite-backlink"><b><a href="#cite_ref-Exploring_Control_Flow_Guard_in_Windows_10_24-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://documents.trendmicro.com/assets/wp/exploring-control-flow-guard-in-windows10.pdf">"Control Flow Guard"</a> <span class="cs1-format">(PDF)</span>. <i>Trend Micro</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2017-01-19</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Trend+Micro&rft.atitle=Control+Flow+Guard&rft_id=https%3A%2F%2Fdocuments.trendmicro.com%2Fassets%2Fwp%2Fexploring-control-flow-guard-in-windows10.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-Windows_10_Control_Flow_Guard_Internals-25"><span class="mw-cite-backlink">^ <a href="#cite_ref-Windows_10_Control_Flow_Guard_Internals_25-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-Windows_10_Control_Flow_Guard_Internals_25-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://www.powerofcommunity.net/poc2014/mj0011.pdf">"Windows 10 Control Flow Guard Internals"</a> <span class="cs1-format">(PDF)</span>. <i>Power of Community</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2017-01-19</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Power+of+Community&rft.atitle=Windows+10+Control+Flow+Guard+Internals&rft_id=http%3A%2F%2Fwww.powerofcommunity.net%2Fpoc2014%2Fmj0011.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-BYPASS_CONTROL_FLOW_GUARD_COMPREHENSIVELY-26"><span class="mw-cite-backlink">^ <a href="#cite_ref-BYPASS_CONTROL_FLOW_GUARD_COMPREHENSIVELY_26-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-BYPASS_CONTROL_FLOW_GUARD_COMPREHENSIVELY_26-1"><sup><i><b>b</b></i></sup></a> <a href="#cite_ref-BYPASS_CONTROL_FLOW_GUARD_COMPREHENSIVELY_26-2"><sup><i><b>c</b></i></sup></a> <a href="#cite_ref-BYPASS_CONTROL_FLOW_GUARD_COMPREHENSIVELY_26-3"><sup><i><b>d</b></i></sup></a></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.blackhat.com/docs/us-15/materials/us-15-Zhang-Bypass-Control-Flow-Guard-Comprehensively-wp.pdf">"Bypass Control Flow Guard Comprehensively"</a> <span class="cs1-format">(PDF)</span>. <i>BlackHat</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2017-01-19</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=BlackHat&rft.atitle=Bypass+Control+Flow+Guard+Comprehensively&rft_id=https%3A%2F%2Fwww.blackhat.com%2Fdocs%2Fus-15%2Fmaterials%2Fus-15-Zhang-Bypass-Control-Flow-Guard-Comprehensively-wp.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-Bromium_CFG_stack_desync-27"><span class="mw-cite-backlink"><b><a href="#cite_ref-Bromium_CFG_stack_desync_27-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://labs.bromium.com/2015/09/28/an-interesting-detail-about-control-flow-guard/">"An interesting detail about Control Flow Guard"</a>. <i>Bromium</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2017-01-19</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Bromium&rft.atitle=An+interesting+detail+about+Control+Flow+Guard&rft_id=https%3A%2F%2Flabs.bromium.com%2F2015%2F09%2F28%2Fan-interesting-detail-about-control-flow-guard%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-Object_Oriented_Exploitation:_New_techniques_in_Windows_mitigation_bypass-28"><span class="mw-cite-backlink"><b><a href="#cite_ref-Object_Oriented_Exploitation:_New_techniques_in_Windows_mitigation_bypass_28-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFThomas2016" class="citation web cs1">Thomas, Sam (18 August 2016). <a rel="nofollow" class="external text" href="https://www.slideshare.net/_s_n_t/object-oriented-exploitation-new-techniques-in-windows-mitigation-bypass">"Object Oriented Exploitation: New techniques in Windows mitigation bypass"</a>. <i>Slideshare</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2017-01-19</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Slideshare&rft.atitle=Object+Oriented+Exploitation%3A+New+techniques+in+Windows+mitigation+bypass&rft.date=2016-08-18&rft.aulast=Thomas&rft.aufirst=Sam&rft_id=http%3A%2F%2Fwww.slideshare.net%2F_s_n_t%2Fobject-oriented-exploitation-new-techniques-in-windows-mitigation-bypass&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-Advancing_Windows_Security_Bluehat_Shanghai_2019-29"><span class="mw-cite-backlink"><b><a href="#cite_ref-Advancing_Windows_Security_Bluehat_Shanghai_2019_29-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE37dMC">"Advancing Windows Security"</a><span class="reference-accessdate">. Retrieved <span class="nowrap">2021-05-19</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Advancing+Windows+Security&rft_id=https%3A%2F%2Fquery.prod.cms.rt.microsoft.com%2Fcms%2Fapi%2Fam%2Fbinary%2FRE37dMC&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-EXTENDED_FLOW_GUARD_UNDER_THE_MICROSCOPE-30"><span class="mw-cite-backlink"><b><a href="#cite_ref-EXTENDED_FLOW_GUARD_UNDER_THE_MICROSCOPE_30-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.offensive-security.com/offsec/extended-flow-guard/">"EXTENDED FLOW GUARD UNDER THE MICROSCOPE"</a>. 18 May 2021<span class="reference-accessdate">. Retrieved <span class="nowrap">2021-05-19</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=EXTENDED+FLOW+GUARD+UNDER+THE+MICROSCOPE&rft.date=2021-05-18&rft_id=https%3A%2F%2Fwww.offensive-security.com%2Foffsec%2Fextended-flow-guard%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> <li id="cite_note-Exploit_Development:_Between_a_Rock_and_a_(Xtended_Flow)_Guard_Place:_Examining_XFG-31"><span class="mw-cite-backlink"><b><a href="#cite_ref-Exploit_Development:_Between_a_Rock_and_a_(Xtended_Flow)_Guard_Place:_Examining_XFG_31-0">^</a></b></span> <span class="reference-text"><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://connormcgarr.github.io/examining-xfg/">"Exploit Development: Between a Rock and a (Xtended Flow) Guard Place: Examining XFG"</a>. 23 August 2020<span class="reference-accessdate">. Retrieved <span class="nowrap">2021-05-19</span></span>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Exploit+Development%3A+Between+a+Rock+and+a+%28Xtended+Flow%29+Guard+Place%3A+Examining+XFG&rft.date=2020-08-23&rft_id=https%3A%2F%2Fconnormcgarr.github.io%2Fexamining-xfg%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3AControl-flow+integrity" class="Z3988"></span></span> </li> </ol></div></div>    </div><noscript><img src="https://login.wikimedia.org/wiki/Special:CentralAutoLogin/start?type=1x1" alt="" width="1" height="1" style="border: none; position: absolute;"></noscript> <div class="printfooter" data-nosnippet="">Retrieved from "<a dir="ltr" href="https://en.wikipedia.org/w/index.php?title=Control-flow_integrity&oldid=1252464912">https://en.wikipedia.org/w/index.php?title=Control-flow_integrity&oldid=1252464912</a>"</div></div> <div id="catlinks" class="catlinks" data-mw="interface"><div id="mw-normal-catlinks" class="mw-normal-catlinks"><a href="/wiki/Help:Category" title="Help:Category">Categories</a>: <ul><li><a href="/wiki/Category:Computer_security" title="Category:Computer security">Computer security</a></li><li><a href="/wiki/Category:Control_flow_integrity" title="Category:Control flow integrity">Control flow integrity</a></li></ul></div><div id="mw-hidden-catlinks" class="mw-hidden-catlinks mw-hidden-cats-hidden">Hidden categories: <ul><li><a href="/wiki/Category:CS1_German-language_sources_(de)" title="Category:CS1 German-language sources (de)">CS1 German-language sources (de)</a></li><li><a href="/wiki/Category:Articles_with_short_description" title="Category:Articles with short description">Articles with short description</a></li><li><a href="/wiki/Category:Short_description_matches_Wikidata" title="Category:Short description matches Wikidata">Short description matches Wikidata</a></li><li><a href="/wiki/Category:Articles_to_be_expanded_from_September_2020" title="Category:Articles to be expanded from September 2020">Articles to be expanded from September 2020</a></li><li><a href="/wiki/Category:All_articles_to_be_expanded" title="Category:All articles to be expanded">All articles to be expanded</a></li><li><a href="/wiki/Category:Articles_to_be_expanded_from_January_2021" title="Category:Articles to be expanded from January 2021">Articles to be expanded from January 2021</a></li></ul></div></div> </div> </main> </div> <div class="mw-footer-container"> <footer id="footer" class="mw-footer" > <ul id="footer-info"> <li id="footer-info-lastmod"> This page was last edited on 21 October 2024, at 13:44<span class="anonymous-show"> (UTC)</span>.</li> <li id="footer-info-copyright">Text is available under the <a href="/wiki/Wikipedia:Text_of_the_Creative_Commons_Attribution-ShareAlike_4.0_International_License" title="Wikipedia:Text of the Creative Commons Attribution-ShareAlike 4.0 International License">Creative Commons Attribution-ShareAlike 4.0 License</a>; additional terms may apply. By using this site, you agree to the <a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Terms_of_Use" class="extiw" title="foundation:Special:MyLanguage/Policy:Terms of Use">Terms of Use</a> and <a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy" class="extiw" title="foundation:Special:MyLanguage/Policy:Privacy policy">Privacy Policy</a>. Wikipedia® is a registered trademark of the <a rel="nofollow" class="external text" href="https://wikimediafoundation.org/">Wikimedia Foundation, Inc.</a>, a non-profit organization.</li> </ul> <ul id="footer-places"> <li id="footer-places-privacy"><a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy">Privacy policy</a></li> <li id="footer-places-about"><a href="/wiki/Wikipedia:About">About Wikipedia</a></li> <li id="footer-places-disclaimers"><a href="/wiki/Wikipedia:General_disclaimer">Disclaimers</a></li> <li id="footer-places-contact"><a href="//en.wikipedia.org/wiki/Wikipedia:Contact_us">Contact Wikipedia</a></li> <li id="footer-places-wm-codeofconduct"><a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Universal_Code_of_Conduct">Code of Conduct</a></li> <li id="footer-places-developers"><a href="https://developer.wikimedia.org">Developers</a></li> <li id="footer-places-statslink"><a href="https://stats.wikimedia.org/#/en.wikipedia.org">Statistics</a></li> <li id="footer-places-cookiestatement"><a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Cookie_statement">Cookie statement</a></li> <li id="footer-places-mobileview"><a href="//en.m.wikipedia.org/w/index.php?title=Control-flow_integrity&mobileaction=toggle_view_mobile" class="noprint stopMobileRedirectToggle">Mobile view</a></li> </ul> <ul id="footer-icons" class="noprint"> <li id="footer-copyrightico"><a href="https://wikimediafoundation.org/" class="cdx-button cdx-button--fake-button cdx-button--size-large cdx-button--fake-button--enabled"><img src="/static/images/footer/wikimedia-button.svg" width="84" height="29" alt="Wikimedia Foundation" loading="lazy"></a></li> <li id="footer-poweredbyico"><a href="https://www.mediawiki.org/" class="cdx-button cdx-button--fake-button cdx-button--size-large cdx-button--fake-button--enabled"><img src="/w/resources/assets/poweredby_mediawiki.svg" alt="Powered by MediaWiki" width="88" height="31" loading="lazy"></a></li> </ul> </footer> </div> </div> </div> <div class="vector-settings" id="p-dock-bottom"> <ul></ul> </div><script>(RLQ=window.RLQ||[]).push(function(){mw.config.set({"wgHostname":"mw-web.codfw.main-5cd4cd96d5-5sq5t","wgBackendResponseTime":188,"wgPageParseReport":{"limitreport":{"cputime":"0.369","walltime":"0.455","ppvisitednodes":{"value":1844,"limit":1000000},"postexpandincludesize":{"value":55653,"limit":2097152},"templateargumentsize":{"value":1477,"limit":2097152},"expansiondepth":{"value":10,"limit":100},"expensivefunctioncount":{"value":3,"limit":500},"unstrip-depth":{"value":1,"limit":20},"unstrip-size":{"value":114711,"limit":5000000},"entityaccesscount":{"value":0,"limit":400},"timingprofile":["100.00% 418.420 1 -total"," 56.43% 236.106 1 Template:Reflist"," 39.73% 166.255 27 Template:Cite_web"," 16.70% 69.867 1 Template:Short_description"," 13.98% 58.485 2 Template:Expand_section"," 12.61% 52.773 2 Template:Ambox"," 8.34% 34.901 1 Template:Distinguish"," 6.49% 27.157 2 Template:Pagetype"," 4.34% 18.177 3 Template:Main_other"," 3.84% 16.084 1 Template:SDcat"]},"scribunto":{"limitreport-timeusage":{"value":"0.231","limit":"10.000"},"limitreport-memusage":{"value":5795895,"limit":52428800}},"cachereport":{"origin":"mw-web.codfw.main-f69cdc8f6-nsrkh","timestamp":"20241122153733","ttl":2592000,"transientcontent":false}}});});</script> <script type="application/ld+json">{"@context":"https:\/\/schema.org","@type":"Article","name":"Control-flow integrity","url":"https:\/\/en.wikipedia.org\/wiki\/Control-flow_integrity","sameAs":"http:\/\/www.wikidata.org\/entity\/Q27627868","mainEntity":"http:\/\/www.wikidata.org\/entity\/Q27627868","author":{"@type":"Organization","name":"Contributors to Wikimedia projects"},"publisher":{"@type":"Organization","name":"Wikimedia Foundation, Inc.","logo":{"@type":"ImageObject","url":"https:\/\/www.wikimedia.org\/static\/images\/wmf-hor-googpub.png"}},"datePublished":"2016-06-01T14:32:35Z","dateModified":"2024-10-21T13:44:08Z","headline":"term in computer security"}</script> </body> </html>