Type-based Control Flow Integrity

This is a Type-based Control Flow Integrity enforcement implementation build on top of LLVM compiler infrastructure.

We use the skeleton of llvm-tutor.

This enforcement should protect you from corrupted code pointers. However, it actually is a coarse-grain implementation because of its Naïve type analysis.

Currently, there are two phases:

1. Type Analysis for ICalls. We currently use FLTA, which means First Layer Type Analysis , to analyze the type of icalls, and resolve the candidate targets set.

The concepts of FLTA is from Where Does It Go?

2. Instrumentation for Runtime Check. Before every icalls, we insert checks to determine the target is in the candidate sets.

Features

• FLTA
• MLTA
• Shadow Stack
• Protection of Metadata
• Runtime Check

Usage

• Modify LT_LLVM_INSTALL_DIR in CMakeList.txt to your llvm directory
• Modify run.sh, choose your bitcode file

LLVM bicode file which we use is generated by wllvm.