COFI break
summary
An anti‑exploitation system uses Intel Processor Trace (and ARM CoreSight) plus kernel 4.1/4.3 perf tools and libipt/simplept to record and decode control flow, builds a hybrid static plus dynamic CFG for Adobe Reader, and matches traced IPs to expected basic blocks. It runs thread and module sync via ETW or a context‑switch callback, ignores JIT code, and flags illegal returns. A trial over a few thousand PDFs DOC PPT and V9 files finds thousands of benign files with zero false positives and detects a handful of malicious files by their stray indirect calls and nonreturning functions.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:20Intel Processor Trace (PT)
- 3:46Configuration options
- 6:07Exploitation and the NX Bit
- 7:10Control Flow Integrity (CF)
- 8:51Prior Work
- 9:41Our Implementation
- 10:35What information is needed to follow the execution and verify it
- 11:50Static Analysis
- 12:20Dynamic Analysis
- 13:46Thread Information
- 18:25Dynamically generated code
- 19:17Scanning Results
- 20:31Coming soon to a motherboard near
related talks
53mResearching New Attack Interfaces On iOS And OSX
26mEfficient Protection of Path-Sensitive Control Security
42mCPU Fuzzing: Automatic Discovery of...
48mCapturing 0Day Exploits With Perfectly Placed Hardware Traps
01h 34mA Little Introduction to Control Flow Integrity in C++
36mLost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented Programming
01h 46mA little Introduction to Control Flow Integrity
48mDPTrace: Dual Purpose Trace for Exploitability Analysis of Program Crashes