Control-Flow Integrity (CFI)

• Idea: constrain indirect control transfers (function pointers, virtual calls, returns) to a set of legitimate targets computed from the program.
• Compiler builds an allowed-target table; an indirect call to an address not in the set is rejected.
• Directly attacks ROP/JOP: hijacked branches usually land on non-entry addresses (mid-instruction gadgets) that CFI forbids.
• Implementations: Clang/LLVM -fsanitize=cfi, Windows CFG, Google's forward-edge CFI. Coarse vs fine-grained trade precision for cost.