MJ0011 - Windows 10 Control Flow Guard Internals

More documents

Recommendations

Info

The Weakness of CFG • Rely on Security of Stack Address • Unaligned <strong>Guard</strong> Functions • Unprotected Images and Processes • Fixed Kernel Address
Stack Address • If we know thread stack address, we could bypass CFG in many ways • Overwrite return address on the stack • CFG only check indirect call target , does not validate “ret” instruction • Bypass some checks on trusted functions and still achieve ROP • Bypass some checks on trusted function to achieve our own purpose • And stack address is not difficult to obtain • Also if you can leak some important data location you could control program behavior indirectly
Page 1 and 2: Windows 10 Control Flow Guard Inter
Page 3 and 4: Intro to Control Flow Guard • New
Page 5 and 6: Control Flow Guard • CFG will pre
Page 7 and 8: New Load Config Structure • New l
Page 9 and 10: Call Target Validation Logics • L
Page 15 and 16: Unmapped Bitmap Processing • RtlD
Page 17 and 18: How CFG Works: Kernel Mode Part •
Page 19 and 20: Process Creation Process • PspApp
Page 21: Shared Bitmap VS. Private Bitmap
Page 25 and 26: Unaligned Guard Functions • Did e
Page 27 and 28: Fixed Kernel Address • Starting f
Page 29 and 30: Acknowledgement • Yuki Chen • V

MJ0011 - Windows 10 Control Flow Guard Internals

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?