Binary Static Analysis for Stack Cookie Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Users of binary software components without access to source code face challenges in verifying the implementation of stack cookie protection, as metadata reliability is questionable and may be misleading, making it difficult to ensure security against buffer overflow attacks.

Innovation Solution

A method using binary static analysis to detect stack cookie utilization in binary software components by examining compiled instructions without executing the software, identifying functions that implement stack cookie protection and generating a security report to confirm its presence.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If metadata is used to indicate stack cookie protection, then verification is simplified, but reliability deteriorates due to potential metadata alteration or incomplete compiler implementation

Engineering Contradiction:
Improveverification simplicityVSAvoidmetadata reliability
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent introduces binary static analysis as an intermediary verification method that examines the actual binary code instructions rather than relying on metadata. This intermediary approach cross-checks compiler-generated metadata against the actual implementation in the binary, providing a more reliable verification mechanism that maintains ease of operation while improving reliability.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If binary static analysis is performed to verify stack cookie protection, then reliability of verification is improved, but device complexity increases due to additional analysis requirements

Engineering Contradiction:
Improveverification reliabilityVSAvoidanalysis system complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The verification process is segmented into distinct phases: initial metadata checking, followed by targeted binary static analysis of specific functions and instructions. This segmentation allows the system to perform comprehensive verification without requiring complex analysis of the entire binary, thereby improving reliability while managing device complexity through divided processing steps.

Inventive Principle:
Principle #1Segmentation

3Measurement precision

If comprehensive binary analysis is conducted to detect stack cookie utilization, then measurement precision is improved, but loss of time increases due to detailed examination requirements

Engineering Contradiction:
Improvestack cookie detection precisionVSAvoidanalysis time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary actions by first examining metadata and function signatures to identify potential stack cookie implementations before conducting detailed binary analysis. This preliminary filtering allows the system to focus time-intensive analysis only on relevant functions, thereby maintaining high measurement precision while reducing overall analysis time through prioritized processing.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3506136B1Detecting stack cookie utilization in a binary software component using binary static analysis
Publication Date: 2022.08.03 BLACKBERRY LTD
  • EP3506136B1 patent drawingFigure 1
  • EP3506136B1 patent drawingFigure 2
  • EP3506136B1 patent drawingFigure 3

AI summary

Systems, methods, and software can be used to detect stack cookie utilization in a binary software component using binary static analysis. In some aspects, one computer-implemented method includes identifying a function defined in the binary software component, the function including one or more instructions; performing a binary static analysis of the function to determine whether the function utilizes stack cookie protection based on the one or more instructions including one or more stack cookie handling instructions; and in response to determining that the function utilizes stack cookie protection, updating a security report for the binary software component to indicate that the function utilizes stack cookie protection.