Brutkey

Petr Tesařík
@ptesarik@infosec.exchange

@amonakov@mastodon.gamedev.place Oh, and yes, I do see a lot of hits in its_return_thunk:

Samples │        ffffffff81d940e0 :
        │        .skip 32, 0xcc
        │        SYM_CODE_START(its_return_thunk)
        │        UNWIND_HINT_FUNC
        │        ANNOTATE_NOENDBR
        │        ANNOTATE_UNRET_SAFE
        │        ret
   6088 │ffffffff81d940e0: ← ret
        │        int3
        │ffffffff81d940e1:   int3


Alexander Monakov
@amonakov@mastodon.gamedev.place

@ptesarik@infosec.exchange ah, this its_return_thunk is new, it doesn't desync the return address prediction stack!

Petr Tesařík
@ptesarik@infosec.exchange

@amonakov@mastodon.gamedev.place Oh, right, I thought I made it clear that this is a jmp to a ret, nothing more.