The other kind of control flow guard check: The combined validate and call
Raymond Chen explains a specific type of Control Flow Guard (CFG) check that combines validation and function calling into a single operation, describing how this "combined validate and call" approach works as a two-in-one package within Windows security mechanisms.
Background
- **Control Flow Guard (CFG)** is a Windows security feature that blocks exploits (like return-oriented programming) by validating call targets before allowing indirect function calls. It was introduced in Windows 8.1 and Windows 10.
- **The Old New Thing** is Raymond Chen's long-running Microsoft blog about Windows internals, history, and programming quirks. Chen works on the Windows shell team and is known for deep-dive explanations of obscure platform behavior.
- This post describes two CFG check variants: a "validate" check (verify a target is a valid call target) and a "validate and call" check (verify *and* jump in one atomic instruction). The combined variant matters for performance and correctness on x86/x64 because it avoids a race condition where the target could be modified between validation and the actual call.
- The distinction is relevant to compiler developers, security researchers, and anyone doing low‑level Windows programming or reverse engineering — not to casual users.