Low-level Software Security by Example
A Theory of Secure Control Flow