MJ0011 - Windows 10 Control Flow Guard Internals

More documents

Recommendations

Info

Unprotected Images and Processes • CFG is rely on compile and link level processing • So third party module and even old version MS binary are not protected • If the main executable image are not made for CFG, CFG will disabled in full process even this process will also load some system modules which can support CFG
Fixed Kernel Address • Starting from Windows8 , MS removed or randomized many fixed executable kernel addresses like PCR of boot CPU/User Shared Data to prevent kernel exploitation • Starting from Windows8.1, MS enhanced KASLR by block many system calls which can obtain kernel address in low integrity process • But also starting from Windows8 , MS introduced some new fixed executable kernel address, like 0xC0802000 which using by CFG
Page 1 and 2: Windows 10 Control Flow Guard Inter
Page 3 and 4: Intro to Control Flow Guard • New
Page 5 and 6: Control Flow Guard • CFG will pre
Page 7 and 8: New Load Config Structure • New l
Page 9 and 10: Call Target Validation Logics • L
Page 15 and 16: Unmapped Bitmap Processing • RtlD
Page 17 and 18: How CFG Works: Kernel Mode Part •
Page 19 and 20: Process Creation Process • PspApp
Page 21 and 22: Shared Bitmap VS. Private Bitmap
Page 23 and 24: Stack Address • If we know thread
Page 25: Unaligned Guard Functions • Did e
Page 29 and 30: Acknowledgement • Yuki Chen • V

MJ0011 - Windows 10 Control Flow Guard Internals

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?