DCFI: Control Flow Integrity for Modern Windows Applications

Control flow integrity or CFI has emerged as an important technique forpreventing attacks on software. Previous approaches relied on staticanalysis and thus largely target static binaries and are limited in howtightly they can constrain a program's runtime behavior. Unfortunately,modern Windows applications make extensive use of dynamically generatedcode. We introduce a new dynamic analysis based approach in DCFI tocontrol flow integrity that precisely learns a program's behavior bymonitoring previous executions. DCFI is the first approach todemonstrate CFI in the presence of dynamic code generation and/orself-modifying code and is immune to recent variations on ROP attacksthat thwart previous CFI approaches. DCFI underapproximates the legalexecutions of software applications and thus can potentially buildtighter constraints than static approaches. As DCFI's knowledge of aprogram becomes more complete, it tightens its constraints on aprogram's execution, making successful attacks progressively moredifficult.We have implemented DCFI in DynamoRIO. Our experiences using DCFIindicate that it can protect modern desktop applications with dynamiccode generation engines including the latest versions of Microsoft Word,Microsoft Excel, Microsoft PowerPoint, Microsoft Outlook, Google Chrome,and Adobe Acrobat. Experiments also show that DCFI effectively detectsknown exploits