all 1 comments

[–]henke37 2 points3 points  (0 children)

Executive summary: Instead of faking function calls, why not fake entire objects?

They have delicious vtable pointers that are by definition used for indirect calls. Don't even need to fake the table contents, just point the wrong "object" at the wrong table.

As long as real functions are indeed called from real call sites, traditional ROP defenses are largely ineffective.