3 ms·
One obvious gotcha with this technique is that a typical attacker will have full access to the assembly code of the target under attack. Therefore, checks agai
by brandmeyer 10y ago
One obvious gotcha with this technique is that a typical attacker will have full access to the assembly code of the target under attack. Therefore, checks against a constant will not be very useful. Fortunately, some microcontrollers are equipped with a hardware random number generator. You can initialize the value of __stack_chk_guard with a function that has __attribute__((constructor)) and does not itself use memory in a way that would cause GCC to issue the stack protector. That way the canary value will be initialized during the startup code before entering main().
- TickleSteve 10y agothe check is also quite weak in that its only really protecting a single point. Its quite easy to stride "over" the protected area rather than going "through" it. TBH, it will only ever protect against accidental errors, not malicious intent.
- _fs 10y agoTrue, but you can use -fstack-check with a well-defined canary space and correct probe interval to prevent the jump over attack you are describing.
- nibnib 10y agoWhy would they have access to full assembly code? Are you assuming any code protection devices on the MCU have already been defeated?