ChoKyuWon / Icaller

Find LLVM-CFI icall gadget

Icaller - find LLVM-CFI forward edge gadget

Usage

cargo run <BINARY_PATH>

Plan

• Find all indirect call and branch(e.g call rax, jmp rcx)
• Find all CFI instrument code based on 1.
• Find all Jump table and allowed offset.
• Get address form jump table and print it

References:

• Control Flow Integrity
• Control Flow Integrity Design Documentation
• Enforcing Forward-Edge Control-Flow Integrity in GCC & LLVM
• Type Metadata
• roper