Short answer
Stack canary have nothing to do with registers.
As it's name may suggest, it is located on the stack.
I think you have misunderstood something, because "between the local variable stack and registers" don't mean anything.
Some of your registers values may have been pushed on the stack, but the stack don't have a direct relation with the registers. Value are taken from the stack then placed in registers (pop
instructions) or the opposite (push
instruction) or modified through certain instructions.
So it should not prevent you from overwriting register's values, as long as you are not corrupting the stack cookie.
Stack canary
The goal of a stack cookie is to prevent stack-based buffer overflow.
A value is pushed on the stack just before the return address of the function.
The layout of the stack would be something like that:
-------------
| |
| local vars |
| |
-------------
| old FP |
-------------
| Canary |
-------------
| Ret |
-------------
The goal of a stack cookie is to prevent an attacker to overwrite the saved return address in order to manipulate the execution flow.
If the exploitation of the program leads to an overflow resulting in the following stack layout:
-------------
| |
| AAAAAAAAAA |
| AAAAAAAAAAA | <- Overflow leading to corruption of the stack
-------------
| AAAAAAAAAAA |
-------------
| AAAAAAAAAAA | <- Canary overwritten
-------------
| 0xDEADBEEF | <- New arbitrary return address
-------------
The program will not returns to 0xDEADBEEF
because the stack cookie was lost in the process. The stack cookie is checked at the end of the function, before returning the execution to the parent's function.
In this case, an exception is raised, and the execution is never changed.
You may understand through this that it have nothing to do with registers. It is only protecting the function's return value. If you find a way (in an exploitation process) to change a local value that is affecting a register, the stack cookie will never prevent you from doing that.