<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 8/31/15 10:43 PM, 慕冬亮 via llvm-dev
wrote:<br>
</div>
<blockquote
cite="mid:CAD-N9QV3ADcJaRKhT2+3A6FJzpJtR9nhdSXhctdjbHHkNabbEQ@mail.gmail.com"
type="cite">
<meta http-equiv="Context-Type" content="text/html; charset=UTF-8">
<div dir="ltr">I want to create an experiment to show the
effectiveness of cfi :
<div>For example , </div>
<div>I first need a program with vulnerability so that we can
hijack its control flow;</div>
<div><br>
</div>
<div>then I enforce cfi of llvm and we can't hijack its control
flow.</div>
<div><br>
</div>
<div>Do you have any advice for me?</div>
</div>
</blockquote>
<br>
The CFI implementation we updated to work with x86-64 for the KCoFI
project is available at <a class="moz-txt-link-freetext" href="https://github.com/jtcriswell/SVA">https://github.com/jtcriswell/SVA</a>. You'll
need to create the exploit code (and potentially the vulnerability)
yourself. If you read the literature on CFI and memory safety (some
of which is cataloged at <a class="moz-txt-link-freetext" href="http://sva.cs.illinois.edu/menagerie">http://sva.cs.illinois.edu/menagerie</a>), you
should be able to find programs and vulnerabilities that have been
used in such experiments.<br>
<br>
That said, doing an experiment will not show that CFI is effective;
it will only show that CFI stops that one particular attack that you
are demonstrating. While this was done in past research papers, it
was only done because it was one of the few methods of evaluating
CFI available. More recent work is showing the deficiencies of
evaluating CFI in this way (in a nutshell, simple CFI defenses can
be thwarted).<br>
<br>
Determining how to measure the effectiveness of defenses against
code-reuse attacks (such as Return-Oriented programming, Return to
Libc attacks, and Non-Control data attacks) is an active area of
research. My students and I are working to devise methods of
evaluating defenses, but as the work is in its very early stages,
that's all I can say about it at present.<br>
<br>
Regards,<br>
<br>
John Criswell<br>
<br>
<blockquote
cite="mid:CAD-N9QV3ADcJaRKhT2+3A6FJzpJtR9nhdSXhctdjbHHkNabbEQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div> </div>
<div> - mudongliang</div>
<div><br>
</div>
<div><br>
<div><br>
<div><br>
</div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
LLVM Developers mailing list
<a class="moz-txt-link-abbreviated" href="mailto:llvm-dev@lists.llvm.org">llvm-dev@lists.llvm.org</a>
<a class="moz-txt-link-freetext" href="http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev">http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
John Criswell
Assistant Professor
Department of Computer Science, University of Rochester
<a class="moz-txt-link-freetext" href="http://www.cs.rochester.edu/u/criswell">http://www.cs.rochester.edu/u/criswell</a></pre>
</body>
</html>