Exploit Development: Unveiling Windows ARM64 Pointer Authentication (PAC)

This report provides a deep dive into Windows ARM64 Pointer Authentication Code (PAC), detailing how the feature is initialized by the bootloader and kernel, gated by feature flags, and enabled per process with distinct user-mode keys. It explains compiler instrumentation for signing and authenticating return addresses, key rotation across user-kernel transitions, and how Secure Kernel/HyperGuard intercepts unauthorized key changes. The paper demonstrates how PAC violations are handled, methods to query state and policies, and positions PAC as a backward-edge control-flow integrity mitigation on ARM, noting potential future enhancements alongside Memory Tagging Extension.