JIT Spraying Never Dies

Known CFG Bypass Methods
• Call VirtualProtect Wrapper to replace ___guard_check_icall_fptr
– The Wrapper itself must be able to pass CFG check.
– The Wrapper is better to take as few arguments as possible to facilitate passing arguments from high
level language.
– Fixed by adding extra logic in wrapper to make sure it can not be used for other purposes.
• Transit via unguarded trampoline (either in executable or in JIT code)
– The trampoline itself must be able to pass CFG check.
– The target address of unguarded indirect control transfer instruction must be controllable.
– Fixed by introducing a CFG check before the indirect control transfer instruction.
• Leverage stack desynchronization situation to overwrite function return address
– Requires a function that contains a controllable function callout, which is used to cause stack imbalance.
– A controllable value must be pushed onto the stack, which happens to overwrite the function’s saved
return address.
– Fixed by enforcing stack pointer sanity check.