StackGuard + $\text{StackGuard}^+$ : Interoperable alternative to canary-based protection of stack smashing

Abstract

This paper introduces a novel software-based approach to enhancing stack smashing protection in C/C++ applications, specifically targeting return-oriented programming attacks, which remain a significant threat to firmware and software security. Traditional canary-based protections are vulnerable to brute-force and format string attacks. Additionally, many stack protection mechanisms require access to the source code or recompilation, complicating the security of existing binaries. This paper proposes a new method, aptly named ${\text{StackGuard}}^{+}$, that modifies the canary-based protection mechanism by altering the code responsible for canary insertion and verification. This change ensures the integrity of the return address while maintaining the original code size, allowing for seamless interoperability without the need for recompilation or additional hardware. The approach can be automated using a Python script, which modifies existing canary-based binaries with only 26 bytes of machine code on the $\times$86-64 platform. Moreover, this approach can be easily adapted to other platforms, including $\times$86 and ARM64.