SACK: Systematic Generation of Function Substitution Attacks Against Control-Flow Integrity

—Control-flow integrity (CFI) is a widely adopted defense against control-flow hijacking attacks, designed to restrict indirect control transfers to a set of legitimate targets. However, even under a precise static CFI policy, attackers can still hijack control flow through function substitution attacks (S UB attacks), by replacing one valid target with another that remains within the allowed set. While prior work has demonstrated the feasibility of such attacks through manual construction, no approach constructs them systematically, scalably, and in an end-to-end manner. In this work, we present S ACK , the first systematic framework for automatically constructing S UB attacks at scale. S ACK collects triggered indirect call targets from benign executions and synthe-sizes security oracles with the assistance of a large language model. It then automatically performs target substitutions and leverages security oracles to detect security violations, while ensuring that execution strictly adheres to precise CFI policies. We apply S ACK to seven widely used applications and successfully construct 419 S UB attacks that compromise critical security features. We further develop five end-to-end exploits based on historical bugs in SQLite3, V8 and Nginx, enabling arbitrary command execution or authentication bypass. Our results demonstrate that S ACK provides a scalable and automated pipeline capable of uncovering large numbers of end-to-end attacks across diverse applications.