4 ms·

What about CET and the ENDBR64/32 instructions? Isn’t there a “shadow stack” as well? Not sure if this is possible with a modern x86 OS, but it also wouldn’t su

What about CET and the ENDBR64/32 instructions? Isn’t there a “shadow stack” as well? Not sure if this is possible with a modern x86 OS, but it also wouldn’t surprise me if there were workarounds either.

exikyut 5y ago
CET = Control-flow Enhancement Technology TL;DR: > The ENDBRANCH (see Section 73 for details) is a new instruction that is used to mark valid jump target addresses of indirect calls and jumps in the program. This instruction opcode is selected to be one that is a NOP on legacy machines such that programs compiled with ENDBRANCH new instruction continue to function on old machines without the CET enforcement. On processors that support CET the ENDBRANCH is still a NOP and is primarily used as a marker instruction by the processor pipeline to detect control flow violations. > The CPU implements a state machine that tracks indirect jmp and call instructions. When one of these instructions is seen, the state machine moves from IDLE to WAIT_FOR_ENDBRANCH state. In WAIT_FOR_ENDBRANCH state the next instruction in the program stream must be an ENDBRANCH. If an ENDBRANCH is not seen the processor causes a control protection exception (#CP), else the state machine moves back to IDLE state. Refs: Above text: https://binpwn.com/papers/control-flow-enforcement-technology-preview.pdf https://binpwn.com/papers/control-flow-enforcement-technolog... (from page 8, page 15 also has info) "How do prior processors execute these?": https://stackoverflow.com/questions/56120231/how-do-old-cpus-execute-the-new-endbr64-and-endbr32-instructions https://stackoverflow.com/questions/56120231/how-do-old-cpus... Random example of someone trying to leverage this capability to harden an app: https://github.com/dotnet/runtime/issues/40100 https://github.com/dotnet/runtime/issues/40100 Random comment that has a bunch of semi-interesting info in it: https://news.ycombinator.com/item?id=26061230 https://news.ycombinator.com/item?id=26061230 (the bit about the lack of Linux support is potentially(?) out of date) LWN article: https://lwn.net/Articles/758245/ https://lwn.net/Articles/758245/

exikyut 5y ago

CET = Control-flow Enhancement Technology TL;DR: > The ENDBRANCH (see Section 73 for details) is a new instruction that is used to mark valid jump target addresses of indirect calls and jumps in the program. This instruction opcode is selected to be one that is a NOP on legacy machines such that programs compiled with ENDBRANCH new instruction continue to function on old machines without the CET enforcement. On processors that support CET the ENDBRANCH is still a NOP and is primarily used as a marker instruction by the processor pipeline to detect control flow violations. > The CPU implements a state machine that tracks indirect jmp and call instructions. When one of these instructions is seen, the state machine moves from IDLE to WAIT_FOR_ENDBRANCH state. In WAIT_FOR_ENDBRANCH state the next instruction in the program stream must be an ENDBRANCH. If an ENDBRANCH is not seen the processor causes a control protection exception (#CP), else the state machine moves back to IDLE state. Refs: Above text: https://binpwn.com/papers/control-flow-enforcement-technology-preview.pdf https://binpwn.com/papers/control-flow-enforcement-technolog... (from page 8, page 15 also has info) "How do prior processors execute these?": https://stackoverflow.com/questions/56120231/how-do-old-cpus-execute-the-new-endbr64-and-endbr32-instructions https://stackoverflow.com/questions/56120231/how-do-old-cpus... Random example of someone trying to leverage this capability to harden an app: https://github.com/dotnet/runtime/issues/40100 https://github.com/dotnet/runtime/issues/40100 Random comment that has a bunch of semi-interesting info in it: https://news.ycombinator.com/item?id=26061230 https://news.ycombinator.com/item?id=26061230 (the bit about the lack of Linux support is potentially(?) out of date) LWN article: https://lwn.net/Articles/758245/ https://lwn.net/Articles/758245/