Breaking the Chain: A Hardware Tour of Control Flow Integrity - Part 1
For the better part of two decades, control-flow hijacking has been the go-to technique for exploiting memory corruption. If you can overwrite a single code pointer—whether that’s a return address, a function pointer, or a C++ vtable slot—you can redirect execution anywhere you want, without needing to inject any custom shellcode. Intel’s Control-flow Enforcement Technology (CET) was designed to tackle this exact problem at the hardware level. It turns certain control-flow transfers into illegal operations, with the CPU enforcing these rules on the fly.
CET breaks down into two main components: a shadow stack to protect function returns, and Indirect Branch Tracking (IBT) to secure indirect calls and jumps.