3

I have to check massive amount of binaries whether they were compiled with the /GS option. I assume a good indicator would be to check if they have stack cookie or not. Do you know any tool that can do this, or any tool that I could build into a script, so I don't have to do it manually?

Edit

Found Binscope, I'll check if it's capable to check more binaries at the same time or it's scriptable.

Edit2

It requires debug symbols, so this is not a solution.

Edit3

https://github.com/NetSPI/PEchecker

  • Do you have the private debug symbols (.pdb) for the binaries? If not, BinScope won't help. – Jason Geffner Nov 24 '14 at 18:27
  • I noticed it. I just checked it and it fails. – Dominik Antal Nov 24 '14 at 18:28
5
  1. you can check the IMAGE_LOAD_CONFIG_DIRECTORY structure, it has a field for the pointer to SecurityCookie's value in the image.

  2. In very old binaries, this structure might be not used, or SecurityCookie RVA is 0 even though the binary may be using /GS. In such case you can scan for the characteristic code signature of the @__security_check_cookie@4 function:

    3B0D........7501C3E9 (VC7)  
    3B0D........0F85........C3 (VC7?)  
    3B0D........7502F3C3E9 (VC8+)
    
  3. you can also scan for the initial cookie value (BB40E64E) in the binary. Though I guess this might produce some false positives.

  • 1
    You can also search for byte string 68 09 04 00 C0, which is push 0xC0000409 (push STATUS_STACK_BUFFER_OVERRUN), used by library function __report_gsfailure. However, as with @igor-skochinsky's third suggestion above, this may cause FPs, so best to use in conjunction with @igor-skochinsky's other suggestions too. – Jason Geffner Nov 24 '14 at 18:52
  • 1
    @JasonGeffner: an old VC7 binary I have here doesn't have that byte sequence - it doesn't raise the exception but only shows a fatal messagebox. – Igor Skochinsky Nov 24 '14 at 18:56
  • 1
    OK, my comment above may cause FPs and FNs ;) – Jason Geffner Nov 24 '14 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.