trailofbits/clang-cfi-showcase — explained in plain English
Analysis updated 2026-07-25 · repo last pushed 2019-02-01
Run the protected and unprotected builds side-by-side to see how CFI stops runtime attacks.
Learn how attackers exploit type confusion and function pointer hijacking in C++ programs.
Evaluate whether enabling CFI in your own application would catch bugs that static analysis misses.
Use the examples as a companion to the Trail of Bits blog post on Clang CFI.
| trailofbits/clang-cfi-showcase | andrewrk/pydaw | mchughalex/skate3recomp | |
|---|---|---|---|
| Stars | 106 | 105 | 108 |
| Language | C++ | C++ | C++ |
| Last pushed | 2019-02-01 | 2010-08-27 | — |
| Maintenance | Dormant | Dormant | — |
| Setup difficulty | moderate | hard | hard |
| Complexity | 2/5 | 3/5 | 4/5 |
| Audience | researcher | developer | developer |
Figures from each repo's GitHub metadata at analysis time.
Requires a specific Clang version (3.7+, 3.9 recommended) and a linker supporting link-time optimization.
Clang CFI Showcase is a collection of example programs that demonstrate a security feature called control flow integrity. The idea is straightforward: when software has a bug, attackers can sometimes exploit it by hijacking the program's execution and redirecting it to run malicious code. Control flow integrity, or CFI, is a defense that stops the program from jumping to places an attacker controls. This project provides hands-on examples showing how that protection works in practice. The repo contains several small programs, each with an intentionally planted bug. Every example builds two versions of the same program: one with CFI protection enabled and one without. By running both, you can see exactly what an attacker might achieve without protection and how CFI blocks them. The examples cover different attack scenarios, such as tricking a program into calling the wrong function, faking the type of an object to access functions that shouldn't be available, or casting an object to an unrelated type it doesn't actually belong to. This project is aimed at security researchers, developers learning about exploit mitigations, or anyone who wants to understand how compilers can help harden software against attacks. It accompanies a Trail of Bits blog post explaining CFI in Clang, and it works best as a companion to that material. Someone evaluating security features for a new application, or a developer curious about how modern compilers catch subtle bugs at runtime, would get a clear picture from these examples. The examples are written in C++ and require a specific version of the Clang compiler (3.7 or later, with 3.9 recommended) along with a linker that supports a technique called link-time optimization. The README includes installation instructions for Ubuntu Linux and MacOS. Notably, all the samples compile cleanly with Clang's maximum warning level, but the bugs they contain are not caught by the compiler itself. They are only detected when the program actually runs and CFI is enabled, which makes the point that CFI catches problems static analysis alone would miss.
A set of C++ example programs that intentionally contain bugs to demonstrate how Clang's control flow integrity (CFI) protection blocks attacks at runtime. Each example builds a protected and unprotected version so you can see the difference.
Mainly C++. The stack also includes C++, Clang, Link-Time Optimization.
Dormant — no commits in 2+ years (last push 2019-02-01).
Setup difficulty is rated moderate, with roughly 30min to a first successful run.
Mainly researcher.
This repo across BitVibe Labs
Verify against the repo before relying on details.