Defenses Against Code Reuse

• ASLR: randomizes libc / stack / PIE base, so you do not know gadget or system addresses. Defeated by an information leak (Class 08). Necessary but not sufficient.
• CFI (Control-Flow Integrity): restricts indirect branches/calls to a set of legitimate targets; arbitrary gadget-to-gadget jumps violate the policy.
• Intel CET:
• Shadow Stack (SHSTK): a protected second copy of return addresses; ret traps if the two disagree — breaks classic ROP directly.
• IBT (Indirect Branch Tracking): indirect targets must begin with endbr64; blocks jumps into the middle of functions/gadgets.