Earlier this month, Yufei Du presented our work, "SoK: Multi-Layer Indirect Call Analysis in the Real World", at the USENIX Association WOOT Conference on Offensive Technologies (WOOT) 2026!
@usenixassociation @wootsecurity
Security tools like CFI and directed fuzzing all depend on accurate call graphs, but indirect calls resolve their targets only at runtime, so static tools have to infer them ahead of time. The state-of-the-practice, type analysis, is fast but crude -- it just matches pointer types, which is way too imprecise in real codebases. "Multi-layer type analysis" (MLTA) promised a fix, adding struct-hierarchy reasoning to sharpen precision without sacrificing soundness, and follow-up work refining the idea has since appeared at multiple top security venues. Our work runs the first systematic study of five state-of-the-art MLTA-like approaches against the single-layer baseline, and finds the promise doesn't hold up: prior evaluations measured precision only over indirect calls a tool successfully resolved, quietly excluding the 20-60% of calls where analysis just failed! (Count those properly and the reported gains mostly disappear.) Every tool is also supposed to fall back to single-layer analysis on failure, but none of the released implementations actually do this, and even after we add that fallback ourselves, every multi-layer approach still loses to the baseline in soundness once compiler optimizations are enabled. We also show hand-crafted attacks can still bypass CFI built on even the most precise of these call graphs.
Joint work with Fabian Monrose and Michalis Polychronakis (@mikepo)!
✳️ Paper: https://cs.brown.edu/people/vpk/papers/sok_mlta.woot26.pdf
💾 Code: https://github.com/yufeidu/SoK-MLTA