Omer Yair - Exploiting Windows Exploit Mitigation for ROP Exploits
Ironically weaponizes Windows Control Flow Guard (CFG) internals to construct more reliable ROP exploit chains by abusing CFG's bitmap.
Summary
Weaponizing CFG for ROP
Omer Yair (Security Researcher, Checkpoint Research) presents a paradoxical technique: using Windows Control Flow Guard (CFG), a code-flow integrity mitigation, to improve the reliability of ROP exploit chains.
CFG Background
CFG is a Windows exploit mitigation that maintains a bitmap of valid indirect call targets. Before any indirect call or virtual function dispatch, a CFG check verifies the target address exists in the bitmap, preventing ROP chains that call into arbitrary code locations.
Bitmap as Information Leaker
Yair demonstrates that the CFG bitmap itself is a side-channel: by testing whether specific addresses are marked as valid call targets in the CFG bitmap, attackers can enumerate which code pages are mapped and executable in the process — bypassing ASLR without a memory disclosure vulnerability.
CFG as Gadget Identifier
Furthermore, the CFG bitmap marks all valid indirect call targets — which are precisely the function entry points used as ROP/JOP gadgets. By querying the bitmap, attackers enumerate function locations across ASLR-randomized DLLs, dramatically improving gadget chain reliability.
Related talks
Briefings·37 min
Marcos Bajo · Christian Rossow
Security researchers reveal how transient execution gadgets bypass modern hardware and compiler-level control flow integrity protections.
CornCon·29 min
Beth Jones
Security researchers examine technical aspects of 2: Beth Jones on "Pirating AV to Bypass Exploit Mitigations".
Ekoparty Security Conference·53 min
Nicolas Alejandro Economou · Enrique Nissim
Provides windows SMEP bypass: U=S and evaluates key implications for security practitioners.