trailofbits/clang-cfi-showcase

Clang CFI Showcase is a collection of example programs that demonstrate a security feature called control flow integrity. The idea is straightforward: when software has a bug, attackers can sometimes exploit it by hijacking the program's execution and redirecting it to run malicious code. Control flow integrity, or CFI, is a defense that stops the program from jumping to places an attacker controls. This project provides hands-on examples showing how that protection works in practice. The repo contains several small programs, each with an intentionally planted bug. Every example builds two versions of the same program: one with CFI protection enabled and one without. By running both, you can see exactly what an attacker might achieve without protection and how CFI blocks them. The examples cover different attack scenarios, such as tricking a program into calling the wrong function, faking the type of an object to access functions that shouldn't be available, or casting an object to an unrelated type it doesn't actually belong to. This project is aimed at security researchers, developers learning about exploit mitigations, or anyone who wants to understand how compilers can help harden software against attacks. It accompanies a Trail of Bits blog post explaining CFI in Clang, and it works best as a companion to that material. Someone evaluating security features for a new application, or a developer curious about how modern compilers catch subtle bugs at runtime, would get a clear picture from these examples. The examples are written in C++ and require a specific version of the Clang compiler (3.7 or later, with 3.9 recommended) along with a linker that supports a technique called link-time optimization. The README includes installation instructions for Ubuntu Linux and MacOS. Notably, all the samples compile cleanly with Clang's maximum warning level, but the bugs they contain are not caught by the compiler itself. They are only detected when the program actually runs and CFI is enabled, which makes the point that CFI catches problems static analysis alone would miss.