Entry Point for CFI implementation in clang/llvm?

Question

I want to implement Control-Flow Integrity in Clang/llvm. (I know there is Forward-Edge CFI already implemented)

My problem is, that I have never implemented anything for a compiler (I am new to compiler based approaches) and therefore don't know where to start. For my implementation I need first to get a list of all calls (internal => no library calls) and than change how functions are ended (for example: pop + jmp instead of ret).

Does anyone know where to start or even if this is possible using the plugin system (LibClang, Clang Plugins, LibTooling)?

Thanks in advance

Answer 1

here is a advanced one CCFI : https://bitbucket.org/CCFI/

it based on this : http://iot.stanford.edu/pubs/mashtizadeh-ccfi-ccs15.pdf

you can learn that how to add your code to each jmp,call,jmp,ret and so on...