All the vfptrs and thunks within all the VTables together form a universal set for virtual call targets. A naive policy will include all vfptrs as valid targets for each callsite. For large binaries, such a policy would contain 1000s of targets per callsite. While still more precise than existing defenses, it would still expose a large attack space. We leverage the offset information at the callsite to obtain a more precise policy.
Given an offset at a callsite, during “Target Accumulation”, we obtain a basic policy for each callsite that encompasses all the vfptrs (and thunks) at the given offset in all the VTables in which the offset is valid. Additionally, we apply two filters to further improve the policy precision. First, we note that target vfptrs for a callsite that is invoked on the same object pointer as the host function must belong to the same VTables as the host function. With this, we apply our first filter, called “Nested Call Filter”. Furthermore, from Ob 3, the calling convention that is presumed at the callsite and the calling
convention adhered to by the target function must be compatible. Accordingly, we apply the second filter called “Calling Convention Filter”.
We considered several other filters, but did not adopt them for various reasons. To name a few, we could infer the number of arguments accepted by each function and require it to match the number of arguments passed at the callsite; we could perform
inter-procedural data flow analysis to keep track of this pointers; and we could perform type inference on function parameters and bind type compatible functions together. However, at a binary level, such analyses are imprecise and incomplete. A function may not always use all the arguments declared in source code, and thus we may not reliably
obtain the argument information in the binary. Inter-procedural data flow analysis and type inference are computationally expensive, and by far not practical for large binaries. We will investigate more advanced filters as future work.
Basic Policy Based on the identified callsites and the VTables V , vfGuard generates a
basic policy. For a given callsite c with byte offset o, we define index k to be the index within the VTable that the byte offset corresponds to (i.e., k = o/4 for 4-bytes wide pointers). The legitimate call targets of c must belong to a subset of all the functions at index k within in all the VTables that contain at least (k + 1) vfptrs. Here we assume VTables to be zero-based arrays of vfptrs. That is:
T argets = {Vi[k] | Vi ∈ V, |Vi| > k},
where Vi is the VTable address point. |Vi| is the number of vfptrs in the VTable at Vi.
Nested Virtual Call Filter In some cases, this pointer used to invoke a virtual function
is later used to make one or more virtual calls within the function body. We refer to such virtual calls as “Nested Virtual Calls”. vfGuard can generate a more precise policy for nested virtual calls.
1. class M { virtual void vMfoo() {
2. this->vFn(); //or vFn();
3. }
In the above example, vFn is a virtual function that is invoked on the same this pointer as its host function M::vMfoo, which is also a virtual function. Underneath, the binary implementation reuses the VTable used to invoke M::vMfoo to retrieve the vfptr (or thunk) pertaining to vFn. That is, between the nested virtual calls and the host virtual function, the vptr acts an invariant. Therefore at the nested callsite, target vFn must belong to a VTable to which M::vfoo also belongs.
Given a virtual callsite with vfptr index k and host virtual function f , we can derive a more precise policy for each nested virtual callsite within f :
T argets = {Vi[k] | Vi ∈ V, f ∈ Vi}
Nested virtual callsites can be easily identified using our intra-procedural data flow analysis. First, we check whether the this pointer at the given callsite is in fact the this pointer for the host function. That is, the expression for this pointer at that callsite should
be ecx0 for thiscall calling convention or esp0+ 4 for stdcall calling convention. Next,
we ensure that the host function is virtual. That is, there must exist at least 1 VTable to which the host function belongs. Finally, the filtered targets are identified using the equation above.
Note that the filter is applicable only in cases where host function is also virtual. If the filter is inapplicable, vfGuard defaults to basic policy.
Calling-Convention based Filtering We filter the target list to be compatible with
pass the implicit this pointer (CallVF) reveals the calling convention that the callee function adheres to.
First, for each of the callsite target functions in the policy, we identify the calling convention the function adheres to. Next, for each callsite, we check if there is a mismatch between the convention at the callsite and the target, if so, we remove such conflicting targets from the list. If we are unable to identify the calling convention of the callee – which is possible if the callee does not use the implicit this pointer, we take a conservative approach and retain the target.
Incomplete Argument Utilization Conceptually, all polymorphs of a function must
accept the same number of arguments. So, one potential filter could be to check if a function accepts the same number of arguments that are passed at the callsite. If not, the mismatching functions can be removed from potential targets for the callsite. However, in the binary, we only see the number of arguments used by a function and not the number of arguments it can accept. Therefore, argument count is not feasible as a filter.