cet-shadow-stack

name

cet-shadow-stack

description

Control Flow Enforcement Technology (CET) and Shadow Stack analysis for binary exploitation. Use this skill whenever the user mentions CET, shadow stack, control flow integrity, ROP/JOP attacks, binary security protections, or needs to understand how modern CPU features prevent control-flow hijacking. Trigger for security research, binary analysis, exploitation learning, or when discussing hardware-level security mitigations.

CET & Shadow Stack Analysis

A skill for understanding and analyzing Control Flow Enforcement Technology (CET) and Shadow Stack security features in binary exploitation contexts.

What This Skill Covers

• CET fundamentals: How Control Flow Enforcement Technology works at the hardware level
• Shadow Stack mechanics: The dedicated return address protection mechanism
• Attack prevention: How CET mitigates ROP and JOP attacks
• Practical analysis: Identifying and working with CET-protected binaries

Core Concepts

Control Flow Enforcement Technology (CET)

CET is a hardware-level security feature designed to prevent control-flow hijacking attacks like Return-Oriented Programming (ROP) and Jump-Oriented Programming (JOP).

Two main components:

1. Indirect Branch Tracking (IBT)

   • Ensures indirect jumps and calls target only valid destinations
   • Uses new instruction markers to designate legal branch targets
   • Prevents arbitrary code execution through gadget chaining

2. Shadow Stack

   • Maintains a protected, hidden copy of return addresses
   • Separate from the regular call stack
   • Validates return addresses before function returns
   • Detects and blocks return address tampering