Finding Truth in the Shadows

This report describes Microsoft’s rollout of Windows Hardware Stack Protection (HSP/CET), highlighting how its user-mode shadow stack can enhance debugging, potentially improve stack-walking performance, and enable detection of call stack spoofing through a PoC (ShadowStackWalk) that compares traditional and shadow stack traces. It discusses current limitations—restricted hardware and software availability, lack of WOW64 support, and the potential for adversaries to adapt by manipulating the shadow stack via privileged operations—while positioning HSP as a growing defensive capability against code-reuse attacks and stack manipulation.