Fix for https://github.com/0xjbb/cet-spoofing-detection/issues/1

util.cpp

@@ -114,6 +114,9 @@ namespace util {
         result.HasShadowStack = true;
 
         result.frames.reserve(64);
+        MEMORY_BASIC_INFORMATION mbi{};
+
+        VirtualQueryEx(process, reinterpret_cast<void*>(ssp), &mbi, sizeof(mbi));
 
         for (size_t i = 0; i < 64; ++i) {
             auto addr = ssp + (i * sizeof(uint64_t));
@@ -127,7 +130,9 @@ namespace util {
             if (ret == 0)
                 break;
 
-            if (ret & 1)
+            // check if it's a restore token.
+            if ( (ret & 1) && (((ret & ~1ULL) >= reinterpret_cast<uint64_t>(mbi.AllocationBase) )
+                && (ret & ~1ULL) < (reinterpret_cast<uint64_t>(mbi.AllocationBase) + mbi.RegionSize)) )
                 continue;
 
             result.frames.push_back(ret);