Patent ID: 11861364
Assignee: nan
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A computer system comprising:
a processor; and
a computer-readable hardware storage device having stored thereon computer-executable instructions that are executable by the processor to configure the computer system to enable shadow stack functionality in an audit mode, the computer-executable instructions including instructions that are executable by the processor to configure the computer system to perform at least:
initiate execution of a thread at the processor, the execution of the thread including:
initiating execution of executable code of an application binary as part of the thread; and
enabling shadow stack functionality for the thread in the audit mode;

based at least on the execution of the thread at the processor in the audit mode, enable at least a portion of a shadow stack as a circular stack;
process an exception triggered by a mismatch between a first return address in a call stack corresponding to the thread and a second return address in a shadow stack corresponding to the thread, including replacing the second return address stored in the shadow stack with the first return address, such that a violation caused by the mismatch is not enforced;
determine that usage of the shadow stack has reached a defined usage threshold;
overwrite a currently used entry of the shadow stack, based on determining that usage of the shadow stack has reached the defined usage threshold, preventing the shadow stack from overflowing a memory region allocated to the shadow stack; and
prevent shadow stack enforcement for the thread based on the currently used entry being overwritten on the shadow stack.