0

I know that pointer to the security cookie in Load Configuration Directory is 4 bytes long for 32-bit exe and 8 bytes long for 64-bit one (source), but what is the size of the security cookie itself?

Edit: the accepted answer links to a long article, here's the quote from it:

When /GS is specified, the compiler automatically links the object file built from gs_cookie.c source file. This file defines __security_cookie as a 64-bit or 32-bit global variable of the type uintptr_t on x64 and x86, respectively.

And since I can't find any official source for gs_cookie.c online here's the important part, which also shows the default values:

#ifdef _WIN64
#define DEFAULT_SECURITY_COOKIE ((UINT_PTR)0x00002B992DDFA232)
#else  /* _WIN64 */
#define DEFAULT_SECURITY_COOKIE ((UINT_PTR)0xBB40E64E)
#endif  /* _WIN64 */

UINT_PTR __security_cookie = DEFAULT_SECURITY_COOKIE;

And just for completeness the documentation for UINT_PTR shows it's just int for 32-bit and __int64 for 64-bit (both unsigned).

1 Answer 1

0

The cookie itself is the same size as a register, 64 bits or 32 bits.

The global cookie is copied into a register then xor'ed with RBP/EBP and stored on the stack.

When unwinding the frame the "stack cookie" is xor'ed against RBP/EBP again before being validated against the global cookie to ensure it hasn't been modified.

Ref: https://docs.microsoft.com/en-us/archive/msdn-magazine/2017/december/c-visual-c-support-for-stack-based-buffer-protection

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.