Intel Control-flow Enforcement Technology Bypass :: Entropic

# 简介

[Intel Control-flow Enforcement Technology (CET)](https://en.wikipedia.org/wiki/
Control-flow_integrity) 由 [Shadow stack (SHSTK)](https://en.wikipedia.org/wiki/
Shadow_stack) 和 [Indirect branch tracking (IBT)](https://en.wikipedia.org/wiki/
Indirect_branch_tracking) 两部分组成，它们分别实现了不同的防护：

> The kernel must map a region of memory for the shadow stack not writable to us
er space programs except by special instructions. The shadow stack stores a copy
 of the return address of each CALL. On a RET, the processor checks if the retur
n address stored in the normal stack and shadow stack are equal. If the addresse
s are not equal, the processor generates an INT #21 (Control Flow Protection Fau
lt).
>
> Indirect branch tracking detects indirect JMP or CALL instructions to unauthor
ized targets. It is implemented by adding a new internal state machine in the pr
ocessor. The behavior of indirect JMP and CALL instructions is changed so that t
hey switch the state machine from IDLE to WAIT_FOR_ENDBRANCH. In the WAIT_FOR_EN
DBRANCH state, the next instruction to be executed is required to be the new END
BRANCH instruction (ENDBR32 in 32-bit mode or ENDBR64 in 64-bit mode), which cha
nges the internal state machine from WAIT_FOR_ENDBRANCH back to IDLE. Thus every
 authorized target of an indirect JMP or CALL must begin with ENDBRANCH. If the 
processor is in a WAIT_FOR_ENDBRANCH state (meaning, the previous instruction wa
s an indirect JMP or CALL), and the next instruction is not an ENDBRANCH instruc
tion, the processor generates an INT #21 (Control Flow Protection Fault). On pro
cessors not supporting CET indirect branch tracking, ENDBRANCH instructions are 
interpreted as NOPs and have no effect.

简单来说就是如下表所示的这些：

| 特性         | SHSTK                  | IBT                          |
| ------------ | ---------------------- | ---------------------------- |
| 所属体系     | Intel CET              | Intel CET                    |
| 防御重点     | 函数返回地址           | 间接跳转 / 调用              |
| 防御攻击类型 | ROP                    | JOP / COP                    |
| 检测时机     | 执行 RET 指令时        | 执行间接跳转后的下一条指令   |
| 硬件实现     | 维护独立的受保护栈空间 | 状态机检查特定的起始标记指令 |

# 检查硬件支持性

使用以下脚本测试 CPU 是否支持 SHSTK 和 IBT：

```c
#include <cpuid.h>
#include <stdint.h>
#include <stdio.h>

int cpu_supports_cet_shadow_stack() {
  uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
  __cpuid_count(7, 0, eax, ebx, ecx, edx);
  return (ecx & (1 << 7)) != 0;
}

int cpu_supports_cet_ibt() {
  uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
  __cpuid_count(7, 0, eax, ebx, ecx, edx);
  return (edx & (1 << 20)) != 0;
}

int main() {
  if (cpu_supports_cet_shadow_stack()) {
    puts("CET Shadow Stack is supported");
  }

  if (cpu_supports_cet_ibt()) {
    puts("CET IBT is supported");
  }
}
```

由于我的 CPU 是 `AMD Ryzen 7 4800H`，所以硬件层还没支持 CET，只能通过 patch 后的
 QEMU 模拟了。

# 模拟环境搭建

这里使用的是 [QEMU-8.2.2-CET: A Pseudo-Intel-CET Plugin of QEMU](https://github.
com/yikesoftware/qemu-8.2.2-cet)，提供了一个伪 Intel CET 插件用于模拟 SHSTK 和 I
BT 。

这个项目最后更新在两年前，而我的内核版本，`gcc` 和 `glibc` 都比较新，所以还需要
自己 patch 几个地方才可以编译。

```plaintext showLineNumbers=false
λ ~/ uname -a
Linux Lux 6.18.6-zen1-1-zen #1 ZEN SMP PREEMPT_DYNAMIC Sun, 18 Jan 2026 00:33:55
 +0000 x86_64 GNU/Linux
λ ~/ ldd --version
ldd (GNU libc) 2.42
Copyright (C) 2024 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
λ ~/ gcc --version
gcc (GCC) 15.2.1 20260103
Copyright (C) 2025 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
```

## Patch QEMU-8.2.2-CET

要改的地方不多，也就下面这三个文件：

```diff showLineNumbers=false
diff --git a/linux-user/strace.c b/linux-user/strace.c
index cf26e5526..a18ad1ee6 100644
--- a/linux-user/strace.c
+++ b/linux-user/strace.c
@@ -51,7 +51,8 @@ struct flags {
 };

 /* No 'struct flags' element should have a zero mask. */
-#define FLAG_BASIC(V, M, N)      { V, M | QEMU_BUILD_BUG_ON_ZERO(!(M)), N }
+// #define FLAG_BASIC(V, M, N)      { V, M | QEMU_BUILD_BUG_ON_ZERO(!(M)), N }
+#define FLAG_BASIC(V, M, N)      { V, M, N }

 /* common flags for all architectures */
 #define FLAG_GENERIC_MASK(V, M)  FLAG_BASIC(V, M, #V)
```

```diff showLineNumbers=false
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 189eec0ec..e0205582c 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -365,18 +365,19 @@ _syscall3(int, sys_sched_getaffinity, pid_t, pid, unsigned
 int, len,
 _syscall3(int, sys_sched_setaffinity, pid_t, pid, unsigned int, len,
           unsigned long *, user_mask_ptr);
 /* sched_attr is not defined in glibc */
-struct sched_attr {
-    uint32_t size;
-    uint32_t sched_policy;
-    uint64_t sched_flags;
-    int32_t sched_nice;
-    uint32_t sched_priority;
-    uint64_t sched_runtime;
-    uint64_t sched_deadline;
-    uint64_t sched_period;
-    uint32_t sched_util_min;
-    uint32_t sched_util_max;
-};
+/* Use kernel-provided struct sched_attr */
+// struct sched_attr {
+//     uint32_t size;
+//     uint32_t sched_policy;
+//     uint64_t sched_flags;
+//     int32_t sched_nice;
+//     uint32_t sched_priority;
+//     uint64_t sched_runtime;
+//     uint64_t sched_deadline;
+//     uint64_t sched_period;
+//     uint32_t sched_util_min;
+//     uint32_t sched_util_max;
+// };
 #define __NR_sys_sched_getattr __NR_sched_getattr
 _syscall4(int, sys_sched_getattr, pid_t, pid, struct sched_attr *, attr,
           unsigned int, size, unsigned int, flags);
```

```diff showLineNumbers=false
diff --git a/linux-user/signal-common.h b/linux-user/signal-common.h
index 3e2dc604c..3f59ffe82 100644
--- a/linux-user/signal-common.h
+++ b/linux-user/signal-common.h
@@ -113,7 +113,9 @@ int process_sigsuspend_mask(sigset_t **pset, target_ulong si
gset,
 static inline void finish_sigsuspend_mask(int ret)
 {
     if (ret != -QEMU_ERESTARTSYS) {
-        TaskState *ts = (TaskState *)thread_cpu->opaque;
+        // TaskState *ts = (TaskState *)thread_cpu->opaque;
+        CPUState *cpu = current_cpu;
+        TaskState *ts = (TaskState *)cpu->opaque;
         ts->in_sigsuspend = 1;
     }
 }
```

## Build

然后进入项目根目录，执行以下指令来 build：

```shellsession frame=none showLineNumbers=false
mkdir build && cd build
../configure --enable-plugins --enable-seccomp --enable-tcg-interpreter --target
-list=x86_64-linux-user --disable-docs --disable-werror
make -j`nproc`
```

Build 完插件会生成在 `./build/tests/plugin/libcet.so`。

我们只需要创建一个软链接：

```shellsession frame=none showLineNumbers=false
ln -s ./build/qemu-x86_64 /path/to/qemu-x86_64-cet
ln -s ./build/tests/plugin/libcet.so /path/to/plugin/libcet.so
```

然后使用下面任意指令来执行编译出来带 SHSTK 或者 IBT 的程序进行测试：

```shellsession frame=none showLineNumbers=false
# without the plugin logs
/path/to/qemu-x86_64-cet -plugin /path/to/plugin/libcet.so,mode=user,ibt=on,ss=o
n,cpu_slots=128 ./test_cet

# with the plugin logs
/path/to/qemu-x86_64-cet -plugin /path/to/plugin/libcet.so,mode=user,ibt=on,ss=o
n,cpu_slots=128 -d plugin ./test_cet
```

# Challenge

```c
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

void timedout(int) {
  puts("timedout");
  exit(0);
}

char g_buf[256];

int main() {
  char buf[16];
  long long int arg1 = 0;
  long long int arg2 = 0;
  void (*func)(long long int, long long int, long long int) = NULL;

  alarm(30);
  signal(SIGALRM, timedout);

  fgets(g_buf, 256, stdin); // My mercy
  fgets(buf, 256, stdin);
  if (func)
    func(arg1, arg2, 0);
}
```

题目代码如上，使用下面的脚本来编译：

```shellsession frame=none showLineNumbers=false
gcc chall.c -fno-stack-protector -fcf-protection=full -mshstk -fno-omit-frame-po
inter -static -o chall
```

## Write-up

TODO

## Exploit

TODO
推荐订阅源

Entropic
