The Beast is in Your Memory
Explore advanced techniques for bypassing modern control-flow integrity (CFI) mechanisms in this Black Hat conference talk. Delve into a comprehensive analysis of recently proposed CFI solutions, including kBouncer, ROPGuard, ROPecker, and CFI for COTS binaries. Learn how to transform existing exploits against Windows into stealthy attacks that evade detection by Windows EMET and other CFI techniques. Discover how a 1MB Windows library (kernel32.dll) can be leveraged to derive a Turing-complete gadget set using only call-preceded gadgets. Gain insights into runtime attacks, Return-Oriented Programming (ROP), and the evolution of CFI implementations. Examine the limitations of coarse-grained CFI proposals and understand the methodology for creating more sophisticated exploits. Conclude with a discussion on real-world exploitation techniques and future directions in CFI research.