MJ0011 - Windows 10 Control Flow Guard Internals

More documents

Recommendations

Info

Booting Process • MiInitializeCfg • Check PspSystemMitigationOptions from CCS\Session Manager\Kernel: MitigationOptions • Calculate CFG bitmap section size by using MmSystemRangeStart • Create CFG bitmap section object(MiCfgBitMapSection32)
Process Creation Process • PspApplyMitigationOptions • PspAllocateProcess • Check mitigation options and set Process->Flags.ControlFlowGuardEnabled • MiCfgInitializeProcess • MmInitializeProcessAddressSpace-> MiMapProcessExecutable • After map system dlls , map CFG bitmap section into process • Reference and commit CFG VAD bits in bitmap • Write bitmap section mapped address to 0xC0802144 • 0xc0802148: bitmap size 0xc0802150: bitmap VAD
Page 1 and 2: Windows 10 Control Flow Guard Inter
Page 3 and 4: Intro to Control Flow Guard • New
Page 5 and 6: Control Flow Guard • CFG will pre
Page 7 and 8: New Load Config Structure • New l
Page 9 and 10: Call Target Validation Logics • L
Page 15 and 16: Unmapped Bitmap Processing • RtlD
Page 17: How CFG Works: Kernel Mode Part •
Page 21 and 22: Shared Bitmap VS. Private Bitmap
Page 23 and 24: Stack Address • If we know thread
Page 25 and 26: Unaligned Guard Functions • Did e
Page 27 and 28: Fixed Kernel Address • Starting f
Page 29 and 30: Acknowledgement • Yuki Chen • V

MJ0011 - Windows 10 Control Flow Guard Internals

Create successful ePaper yourself

Delete template?

Save as template?