This tutorial will show you how to check if a process is using Hardware-enforced Stack Protection in Windows 10 an Windows 11.
Hardware-enforced Stack Protection offers robust protection against Return Oriented Programming (ROP) exploits since it maintains a record of the intended execution flow of a program.
The Kernel Mode Hardware Enforced Stack Protection security feature is applicable to Windows 11, version 22H2 and above, and provides additional security enhancement for kernel code.
You can use Task Manager to understand the state of enforcement of processes for Hardware-enforced Stack Protection.
Reference:
Understanding Hardware-enforced Stack Protection | Microsoft Community Hub
ROP (Return Oriented Programming) based control flow attacks have become a common form of attack. In this post, we will describe our efforts to harden...
techcommunity.microsoft.com
Here's How:
1 Open Task Manager (Ctrl+Shift+Esc).
2 Open the Details page in Task Manager. (see screenshot below)
3 Add the Hardware-enforced Stack Protection column to the "Processes" window in Task Manager if not already added. (see screenshot below)
Add or Remove Columns in Task Manager in Windows 11
This tutorial will show you how to add or remove columns for details in Task Manager for your account in Windows 11. Task Manager can be used to view and manage your processes, performance statistics, app history, startup apps, users, process details, and services in Windows 11. Starting with...
www.elevenforum.com
4 Look in the Hardware-enforced Stack Protection column to see if each process you want is currently utilizing the Hardware-enforced Stack Protection security feature or not. (see screenshot below)
Disabled = Process is not protected by Hardware-enforced Stack Protection.
Compatible modules only = Compatibility mode. Compatibility mode provides a more flexible enforcement of stacks, at module granularity. When a return address mismatch occurs in this mode, it is checked to see if 1) it is not in an image binary (from dynamic code) or 2) in a module that is not compiled for /CETCOMPAT. If either hold true, the execution is allowed to continue.
All modules = Strict mode. Strictly enforces stack protections and will terminate the process if the intended return address is also not on the stack.
That's it,
Shawn Brink
Last edited:
