Control-flow integrity technology based on the combination of software and hardware

For shadow stack, balancing security and performance was difficult, and the forward CFI (control-flow integrity) scheme implemented by software was too expensive and difficult to be deployed in practice. A hybrid CFI scheme based on software and hardware integration, named SHCFI (control-flow integrity based on the combination of software and hardware), was proposed. Decompilation was undergone by the program using a binary rewriter to generate an intermediate representation, and various transfer instruction types were identified. For the protection of backward control flow, a novel parallel shadow stack scheme was introduced, featuring encrypted return addresses. This involved XOR encryption of return addresses on the stack using random numbers, with the encrypted results stored securely in a shadow stack located at a fixed offset on the original stack. During function returns, addresses in the shadow stack underwent XOR decryption, and the decrypted results served as the actual return addresses. For forward control flow protection, the hardware ENDBRANCH state machine instruction was utilized to mark the target addresses of indirect transfer instructions. At runtime, legitimacy checks were applied to these target addresses, thereby reducing performance overhead. Experimental results demonstrated that programs fortified with SHCFI effectively defended against code reuse attacks, exhibiting favorable runtime overhead.