Retrofitting Intel CET’s Indirect Branch Tracking into Legacy Binaries through Static Binary Rewriting - Ribeiro, Bruno R.; Rimsa, Andrei; Tymburibá, Mateus; Souto, Eduardo P. (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais do XXVI Simpósio Brasileiro de Cibersegurança, 2026)
Modern processors increasingly embed hardware support for control-flow integrity. Intel CET’s Indirect Branch Tracking (IBT) restricts indirect transfers to targets explicitly marked with endbr64. However, legacy binaries that cannot be recompiled remain outside this protection, leaving deployed software exposed to code-reuse attacks. This paper presents BIN2CET, an automated static rewriting system for retrofitting IBT support into legacy ELF binaries without requiring perfect control-flow recovery. The system combines endbr64-based target instrumentation, relocation-aware trampolines to preserve overwritten instructions, and conservative notrack handling for indirect branches that cannot be safely normalized. We evaluate BIN2CET on the 102 CoreUtils programs compiled under multiple optimization levels. The results show complete coverage of recovered function-entry targets in the non-optimized setting and above 80% coverage under optimized layouts. Runtime overhead ranges from approximately 22% to 40%, while attack-surface analysis shows that the policy-valid indirect-control-transfer surface is reduced to less than 1% of the syntactic gadget space. These results indicate that automated static rewriting is a practical path for bringing IBT compatibility to legacy binaries.