  Polymorphism and inheritance make C++ suitable for writing complex software,
but significantly increase the attack surface because the implementation relies
on virtual function tables (vtables). These vtables contain function pointers
that attackers can potentially hijack and in practice, vtable hijacking is one
of the most important attack vector for C++ binaries.
  In this paper, we present VTable Pointer Separation (VPS), a practical
binary-level defense against vtable hijacking in C++ applications. Unlike
previous binary-level defenses, which rely on unsound static analyses to match
classes to virtual callsites, VPS achieves a more accurate protection by
restricting virtual callsites to validly created objects. More specifically,
VPS ensures that virtual callsites can only use objects created at valid object
construction sites, and only if those objects can reach the callsite. Moreover,
VPS explicitly prevents false positives (falsely identified virtual callsites)
from breaking the binary, an issue existing work does not handle correctly or
at all. We evaluate the prototype implementation of VPS on a diverse set of
complex, real-world applications (MongoDB, MySQL server, Node.js, SPEC
CPU2017/CPU2006), showing that our approach protects on average 97.8% of all
virtual callsites in SPEC CPU2006 and 97.4% in SPEC CPU2017 (all C++
benchmarks), with a moderate performance overhead of 11% and 9% geomean,
respectively. Furthermore, our evaluation reveals 86 false negatives in VTV, a
popular source-based defense which is part of GCC.
