Stitching the Gadgets: On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection

This paper provides the first comprehensive security analysis of various CFI solutions, and shows that with bare minimum assumptions, turing-complete and real-world ROP attacks can still be launched even when the strictest of enforcement policies is in use.