Shadow Call Stack (SCS) in Android: Mechanism, Requirements, and Implementation
Android’s Shadow Call Stack (SCS), silently enabled since Android R on AArch64 devices, stores return addresses in a protected register‑based stack separate from the regular stack, complementing stack canaries and requiring hardware support, while developers can activate it via -fsanitize=shadow-call-stack and avoid using X18 elsewhere.