CET-Compliant Callstack Spoofing in Rust Using Thread Pool & Enum Trampolining
CET-compliant callstack spoofing in Rust using thread pool and enum trampolining.
A method for CET-compliant callstack spoofing on Intel CET-enabled hardware has been developed. The technique integrates thread pool execution for a clean stack base, enum callback trampolining for a real signed mid-stack frame, and indirect syscalls. The core contribution is the CET compliance mechanism, using a jmp-based context switch with direct shadow stack pointer reconciliation. Implemented in Rust with inline assembly.