Protecting Software Against Exploitation with DARPA’s CFAR

Summary: Trail of Bits describes its work under DARPA's Cyber Fault-Tolerant Attack Recovery (CFAR) program, which runs multiple variants of a program in parallel and flags behavioral divergence between them to detect 0-day exploits, memory corruption, and undiscovered bugs. The team uses its McSema tool to translate binary-only software to LLVM IR so the multicompiler can generate variants with shuffled stack and global variable layouts, since source code may be unavailable for proprietary or older applications.
What you should know: The approach targets binaries where source isn't available or editable, the same condition that rules out standard mitigations like stack guard, CFG, and CFI, which require source code and build process changes. Stack variable recovery is not perfect, and global variable sizes currently depend on DWARF debug information, so the protection has known gaps on binaries lacking that data.

Read the original at Trail of Bits Blog ↗