SoK: Multi-Layer Indirect Call Analysis in the Real World
summary
A systematic evaluation of five multi-layer type analyses (MLTA, DeepType, TFA, HPCFI, Callgraph) plus LLVM-CFI runs on 13 real-world apps and extracts ground-truth targets with AFL++. The study finds up to 63% empty targets when implementations omit fallbacks, a hybrid chooser reaches best precision with 96% recall, and LLVM-CFI misses targets in 3/13 programs. Compiler optimizations at O2 cause widespread soundness loss and Callgraph crashes, and most multi-layer defenses still fail the three-pattern type-collision attack (only HPCFI’s pointer-analysis fallback helps).
AI-written summary · about
chapters (10)
- 0:00Multi-layer indirect call analysis intro
- 1:55Single-layer type analysis limits
- 3:40How multi-layer type analysis works
- 6:11Evaluating real-world approaches
- 9:05Results without compiler optimizations
- 10:28Compiler optimizations impact
- 11:10LLVM-CFI soundness issues
- 12:14Testing CFI against type collision
- 15:51Future research recommendations
- 16:33Conclusion and challenges
related talks
36mA Hybrid Alias Analysis Framework and Its Application to Protecting the Linux Kernel
18mCompiling countermeasures against fault attacks with “Tracing LLVM”
21mFlow-Analysis-Based Closure Optimization
38mStatic Code Analysis - A Behind-the-scenes Look
22mA Type- And Control- Flow Analysis for System FC (Extended Abstract)
38mTaking Kernel Hardening to the Next Level
38mEffective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis
46mIncreasing the Analysis Surface of Large Language Models