Binary Static Analysis for Stack Cookie Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users of binary software components without access to source code face challenges in verifying the implementation of stack cookie protection, as metadata reliability is questionable and may be misleading, making it difficult to ensure security against buffer overflow attacks.
Innovation Solution
A method using binary static analysis to detect stack cookie utilization in binary software components by examining compiled instructions without executing the software, identifying functions that implement stack cookie protection and generating a security report to confirm its presence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If metadata is used to indicate stack cookie protection, then verification is simplified, but reliability deteriorates due to potential metadata alteration or incomplete compiler implementation
Solution Approach 1:
The patent introduces binary static analysis as an intermediary verification method that examines the actual binary code instructions rather than relying on metadata. This intermediary approach cross-checks compiler-generated metadata against the actual implementation in the binary, providing a more reliable verification mechanism that maintains ease of operation while improving reliability.
2Reliability
If binary static analysis is performed to verify stack cookie protection, then reliability of verification is improved, but device complexity increases due to additional analysis requirements
Solution Approach 1:
The verification process is segmented into distinct phases: initial metadata checking, followed by targeted binary static analysis of specific functions and instructions. This segmentation allows the system to perform comprehensive verification without requiring complex analysis of the entire binary, thereby improving reliability while managing device complexity through divided processing steps.
3Measurement precision
If comprehensive binary analysis is conducted to detect stack cookie utilization, then measurement precision is improved, but loss of time increases due to detailed examination requirements
Solution Approach 1:
The system performs preliminary actions by first examining metadata and function signatures to identify potential stack cookie implementations before conducting detailed binary analysis. This preliminary filtering allows the system to focus time-intensive analysis only on relevant functions, thereby maintaining high measurement precision while reducing overall analysis time through prioritized processing.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods, and software can be used to detect stack cookie utilization in a binary software component using binary static analysis. In some aspects, one computer-implemented method includes identifying a function defined in the binary software component, the function including one or more instructions; performing a binary static analysis of the function to determine whether the function utilizes stack cookie protection based on the one or more instructions including one or more stack cookie handling instructions; and in response to determining that the function utilizes stack cookie protection, updating a security report for the binary software component to indicate that the function utilizes stack cookie protection.