Method and apparatus for determining binary function entry

An apparatus for determining a valid binary function entry, the apparatus comprising:

• a central processing unit (CPU);
• a memory;
• and
• a complier, wherein the complier, when run by the CPU, executes a Control-Flow Enforcement Technology (CET) function performed at a hardware level to guarantee Control-Flow Integrity (CFI) of a binary code, and wherein the compiler comprises:
• a parser configured to parse the binary code to distinguish a text section and an exception handling section of the binary code, wherein the binary code is previously processed, via the compiler using the CET function, by inserting one or more end branch instructions into the text section at one or more end branch instructions at one or more binary function entries;
• a disassembler configured to disassemble the text section to determine addresses of the one or more end branch instructions, addresses of direct call targets, and addresses of direct jump targets;
• a filter configured to determine an indirect return function call address and an exception handling block address from the addresses of the one or more end branch instructions, and exclude the indirect return function call address and the exception handling block address from the addresses of the one or more end branch instructions, such that each invalid binary function entry of the one or more binary function entries associated with the indirect return function call address and the exception handling block address are excluded;
• and
• a tail call selector configured to determine a tail call corresponding to the valid binary function entry of the one or more binary function entries from the addresses of the direct jump targets.

A method for determining a valid binary function entry, the method comprising:

• executing, via a compiler, a Control-Flow Enforcement Technology (CET) function performed at a hardware level to guarantee Control-Flow Integrity (CFI) of a binary code by:
• generating, via the compiler using the CET function, an end branch instruction address from the binary code as a candidate set, wherein the binary code is previously processed, via the compiler using the CET function, by inserting one or more end branch instructions into the binary code at one or more binary function entries;
• determining, via the compiler using the CET function, an indirect return function call address from the addresses of the one or more end branch instructions;
• determining, via the compiler using the CET function, an exception handling block address from the addresses of the one or more end branch instructions;
• excluding, via the compiler using the CET function, the indirect return function call address and the exception handling block address from the candidate set, such that each invalid binary function entry of the one or more binary function entries associated with the indirect return function call address and the exception handling block address are excluded;
• and
• determining, via the compiler using the CET function, an address of a tail call function and including the address of the tail call function in the candidate set, wherein the address of the tail call function is associated with the valid binary function entry.