Exploit mitigations (CFG, ACG, ASLR, CIG)

How it works

1. 1**ASLR** (Address Space Layout Randomization) randomizes where images, stacks, and heaps load on each boot/run, so an attacker can't hardcode addresses of useful gadgets or functions.
2. 2**CFG** (Control Flow Guard) has the compiler emit a bitmap of valid indirect-call targets; at runtime, every indirect call is checked against that bitmap before it's taken, so corrupting a function pointer to point somewhere arbitrary no longer works.
3. 3**ACG** (Arbitrary Code Guard) makes a process's memory pages mutually exclusive between writable and executable, and blocks remapping existing executable pages as writable — so even a successful exploit can't inject and run new shellcode in that process.
4. 4**CIG** (Code Integrity Guard) restricts a process to loading only images signed by Microsoft (or an allow-listed signer), closing off the common bypass of loading an attacker-supplied but otherwise 'legitimate' DLL to get code execution without injecting raw shellcode.
5. 5These are opt-in per process (via `SetProcessMitigationPolicy` / the image's load config, and increasingly on by default for browsers and other high-risk processes), not blanket OS behavior — which is why mitigation posture varies a lot between processes on the same machine.

Key terms

CFG bitmap

The compiler-generated table of valid indirect-call targets, checked by `ntdll!LdrpValidateUserCallTarget` on each guarded call.

W^X

Shorthand for 'writable xor executable' — the page-permission invariant ACG enforces.

Mitigation policy

The per-process bitmask of which of these defenses are active, queryable via `GetProcessMitigationPolicy`.