How to Survive the Hardware Assisted Control-Flow Integrity Enforcement

on YouTube ↗01h 05m

" summary

Presentation analyzes Intel CET on Windows 10 RS5 and 19H1 and shows working PoCs that bypass protections despite CET: IBT is not yet enabled in shipping Windows so CFG remains bypassable; demonstrations use a JavaScript-only exploitation chain plus arbitrary read/write to tamper loader structures, data-only corruption, race conditions in exception/frame handling to hijack function pointers, and NtContinue thread-context manipulation. Shadow stacks block return-overwrite attacks, but CET does not make arbitrary code execution easy—PoCs achieve control-flow hijacks but arbitrary code execution becomes significantly harder.

AI-written summary · about

" chapters (13)

1. 0:00Intro
2. 3:21Software-based Control-flow Integrity Enforcement - Microsoft Control Flow Guard (CFG)
3. 7:45Software-based Control-flow Integrity Enforcement - Microsoft Return Flow Guard (RFG)
4. 13:39Intel Control-flow Enforcement Technology - The Principle of Shadow Stack
5. 15:30Intel Control-flow Enforcement Technology - The Principle of IBT.
6. 25:52Intel CET Implementation on Windows 10 - Shadow Stack Setup in
7. 29:24Shadow Stack Switching in Switch ToFiberContext
8. 36:38Control-flow Hijacking and ACE on Windows 10 with CET enabled - Possible Ways to Circumvent CET
9. 38:49with CET enabled - CFG Bypass by Abusing Ldrpwork Mechanism
10. 42:5910 with CET enabled - Vulnerable Code Analysis of Unwind Handler Hijacking
11. 45:40Control-flow Hijacking and ACE on Windows 10 with CET enabled - Vulnerable Code Analysis of Frame Consolidation Unwind Callback Routine Hijacking
12. 49:51Control-flow Hijacking and ACE on Windows 10 with CET enabled - Vulnerable Code Analysis of Thread Context Hijacking in Exception Unwind Process
13. 51:37Control-flow Hijacking and ACE on Windows 10 with CET enabled - Thread Context Hijacking in Exception Unwind Process

" related talks

• 01h 46mA little Introduction to Control Flow IntegrityJames McNellis · Meeting C++ 2025
• 01h 34mA Little Introduction to Control Flow Integrity in C++James McNellis · C++Now 2026
• 29mA Technical Deep Dive Into Intel CET Implementation in LinuxJay Tharwani · Linux Security Summit North America 2026
• 36mLost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented ProgrammingSeunghun Han · Black Hat USA 2023
• 26mEfficient Protection of Path-Sensitive Control SecurityTaesoo Kim, Bill Harris, Ren Ding, Chenxiong Qian, Chengyu Song, Wenke Lee · 26th USENIX Security Symposium (USENIX Security '17)
• 44mLinux Kernel Control-Flow Integrity Sup...Peter Zijlstra, Sami Tolvanen, Mark Rutland, João Moreira · Linux Plumbers Conference 2022
• 27mControl Flow Integrity on RISC-VSylvain Guilley · Week of Open Source Hardware 2019
• 01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...Allison Randal, Giorgos Christou · RISC-V Summit 2022