Package ghidra.app.util.bin.format.pe

Class ControlFlowGuard

java.lang.Object

ghidra.app.util.bin.format.pe.ControlFlowGuard

public class ControlFlowGuard
extends java.lang.Object

ControlFlowGuard is a platform security feature that was created to combat memory corruption vulnerabilities.

ReturnFlowGuard was introduced as an addition to ControlFlowGuard in the Windows 10 Creator's update.

Field Summary

Fields

Modifier and Type	Field	Description
static java.lang.String	GuardCFAddressTakenIatTableName
static java.lang.String	GuardCFFunctionTableName
static java.lang.String	GuardCfgTableEntryName

Constructor Summary

Constructors

Constructor	Description
ControlFlowGuard()

Method Summary

Modifier and Type	Method	Description
static void	markup(LoadConfigDirectory lcd, Program program, MessageLog log, NTHeader ntHeader)	Perform markup on the supported ControlFlowGuard and ReturnFlowGuard functions and tables, if they exist.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

GuardCFFunctionTableName

public static java.lang.String GuardCFFunctionTableName

GuardCFAddressTakenIatTableName

public static java.lang.String GuardCFAddressTakenIatTableName

GuardCfgTableEntryName

public static java.lang.String GuardCfgTableEntryName

Constructor Detail

ControlFlowGuard

public ControlFlowGuard()

Method Detail

markup

public static void markup(LoadConfigDirectory lcd,
                          Program program,
                          MessageLog log,
                          NTHeader ntHeader)

Perform markup on the supported ControlFlowGuard and ReturnFlowGuard functions and tables, if they exist.

Parameters:

lcd - The PE LoadConfigDirectory.

program - The program.

log - The log.

ntHeader - The PE NTHeader.