function calls (de-virtualization) CPin pin { GPIO_PIN_6 }; CLed led { &pin }; while (true) { led.toggle(); delay(1000); } 41Dynamic Polymorphism without de-virtualization 42

: push 08000198 <_ZN4CPin5resetEv>: ... 080001b0 <_ZN4CPin3setEv>: ...Dynamic Polymorphism without de-virtualization Load the vtable address in r3. 43

: push {r0, r1, r2, lr} ldr r3, [pc, #28] 0x08000258 : 0x080001b1 0x0800025c : 0x08000199 CPin vtableDynamic Polymorphism without de-virtualization Load the address of the set method from the vtable into r3. 44

: push {r0, r1,

soon Shadow Stack Control-flow Enforcement Technology (CET)) CIG Code Integrity Guard Virtualization-based security (VBS) enclaves Redirection GuardCurrent Defensive Strategies Control flow high-jacking Out-of-Process ● Sandboxing ● AppContainers – Consider Low IL ● Secure Enclaves (Trusted Execution) ○ Virtualization-based Security (VBS) ○ Intel Software Guard Extensions (Intel SGX)Fuzzing ● LibFuzzer + Address

compiler’s source code parser entirely! 6 0 Future stuff to be excited about!Alternative Field de-virtualization • every impl ptr to member being equally sized • But MSVC... • PtrToMember = 4 bytes for POD

type_info objects • Template Instantiations 68Indirect Call Overhead • Recent (2020) work on de-virtualization in clang: • “Modeling the Invariance of Virtual Pointers in LLVM” Piotr Padlewski, Krzysztof

German Aerospace Center (DLR) Institute of Software Methods for Product Virtualization VECTORIZING A CFD CODE WITH STD::SIMD SUPPLEMENTED BY (ALMOST) TRANSPARENT LOADING AND STORINGMotivation: The

when using special hardware to help virtualize the guest operating system. In particular, the virtualization extensions are quite powerful, and so are paravirtualization techniques.Valgrind A Framework