Check if binary was compiled with security checks (/GS)

Question

I have to check massive amount of binaries whether they were compiled with the /GS option. I assume a good indicator would be to check if they have stack cookie or not. Do you know any tool that can do this, or any tool that I could build into a script, so I don't have to do it manually?

Edit

Found Binscope, I'll check if it's capable to check more binaries at the same time or it's scriptable.

Edit2

It requires debug symbols, so this is not a solution.

Edit3

https://github.com/NetSPI/PEchecker

Answer 1

1. you can check the IMAGE_LOAD_CONFIG_DIRECTORY structure, it has a field for the pointer to SecurityCookie's value in the image.

2. In very old binaries, this structure might be not used, or SecurityCookie RVA is 0 even though the binary may be using /GS. In such case you can scan for the characteristic code signature of the @__security_check_cookie@4 function:

   3B0D........7501C3E9 (VC7)  
   3B0D........0F85........C3 (VC7?)  
   3B0D........7502F3C3E9 (VC8+)
   

3. you can also scan for the initial cookie value (BB40E64E) in the binary. Though I guess this might produce some false positives.