INVESTIGATING KERNEL MODE SHADOW STACKS ON WINDOWS

Summary from the TLDR InfoSec newsletter

Shadow stacks are a security feature that Intel CET implements to defend against ROP attacks by shadowing and comparing the current stack against a protected, read-only copy. The “Secure Kernel” is a Windows feature that allows the kernel to run in a virtualized form by a protected Secure Kernel. This post utilizes the SourcePoint debugger to perform a novel dynamic analysis of the Windows Secure Kernel.