Introduction: The Fort Knox of Android Security

Android, at its core, is a Linux-based operating system designed with multiple layers of security. Control-Flow Integrity (CFI) stands as one of its most crucial defenses, particularly against memory corruption vulnerabilities that could otherwise lead to arbitrary code execution. CFI aims to ensure that program execution follows a legitimate path, preventing attackers from hijacking control flow by corrupting function pointers, return addresses, or virtual table entries.

On ARM64 architectures, Android leverages advanced CFI mechanisms, including LLVM’s CFI implementation and more recently, the Generic Kernel Image (GKI) CFI for kernel integrity. These systems enforce both forward-edge (indirect calls, virtual calls) and backward-edge (function returns) control flow checks, making traditional Return-Oriented Programming (ROP) or Jump-Oriented Programming (JOP) attacks significantly harder. This article delves into the complexities of these protections and explores a hypothetical exploit chain designed to bypass CFI by meticulously chaining primitives.

Understanding CFI on ARM64

CFI’s primary objective is to restrict where execution can jump or return. On ARM64, this often involves:

• Indirect Branch Protection: For indirect function calls (e.g., through function pointers or virtual tables), CFI verifies that the target address corresponds to a valid, expected function type. Metadata compiled into the binary assists in these checks.
• Return Address Protection: Mechanisms like Branch Target Identification (BTI) and Pointer Authentication Codes (PAC) are employed. BTI ensures indirect branches land only on specific instruction types (like BTI instructions), while PAC uses cryptographic signatures to protect return addresses stored on the stack (register x30 for link register).

When a program attempts an indirect call, CFI runtime checks validate the target address against a whitelist of valid targets for the given call site. If the target doesn’t match the expected type or is outside the allowed set, the program terminates.

Exploitation Primitives: The Building Blocks

Bypassing modern CFI requires a sophisticated approach, often involving chaining multiple vulnerabilities, or