Compatibilização de binários legados com a proteção de rastreamento de desvios indiretos

Abstract

The increasing sophistication of code-reuse attacks, such as Return-Oriented Programming (ROP) and Jump-Oriented Programming (JOP), has motivated the adoption of stronger mechanisms for protecting control-flow integrity. Among these protections, Intel's Control-flow Enforcement Technology (CET) stands out, consisting primarily of Indirect Branch Tracking (IBT) and Shadow Stack. Although modern compilers can generate CET-compatible binaries, much legacy software remains unprotected because it cannot be recompiled, either due to unavailable source code, maintenance constraints, or dependence on older environments. This work proposes BIN2CET, an automated static binary rewriting system that makes legacy ELF binaries compatible with Intel CET's IBT mechanism without requiring source code or complete control-flow graph recovery. The approach combines three complementary strategies: inserting endbr64 instructions at recovered indirect-branch targets, preserving overwritten instructions through relocation-aware trampolines, and conservatively using notrack when safe target rewriting is not possible. The system uses LIEF for ELF-level manipulation and an extended version of E9Patch to materialize trampolines, redirect control flow, and preserve the semantics of position-sensitive instructions, such as RIP-relative references. The experimental evaluation was conducted on the 102 programs of the Coreutils suite, compiled as PIE (Position-Independent Executable) binaries under the -O0, -O2, and -O3 optimization levels. The results indicate complete coverage of recovered function-entry targets in the unoptimized scenario and coverage above 80% in optimized layouts. Performance measurements show execution overhead between approximately 22% and 42% for the main Linux perf timing counters, while binary size increases remain consistent with the insertion of markers, redirections, and trampolines. In addition, the attack surface analysis with ROPgadget indicates that the effective surface of policy-valid indirect transfers is reduced to less than 1% of the syntactic gadget space identified. These results show that automated static binary rewriting is a viable path for making legacy software compatible with IBT requirements, while preserving executable functionality and supporting future binary-hardening extensions.