Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

According to this answer, it's possible to compile a GCC-based application without certain buffer overflow techniques. Perhaps this is even possible with Visual Studio.

How can I audit a given EXE or DLL if it has the relevant anti-buffer overflow technologies in it? Is it even possible?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

ASLR is a runtime feature provided by the operating system when the binary file is executed; if the OS decides it so, it will apply it on the DLL loaded by the executable, regardless of how the executable and the DLL were compiled. What can be seen in the executable is whether it is itself "relocatable" (i.e. like a DLL), in which case ASLR can also be applied on the EXE code itself.

Situation with DEP is mostly similar: it is up to the operating system (helped by what the hardware can do) whether the prohibition to "execute" data pages will be enforced or not. The best you could find by auditing an EXE is that it may include features which cannot work in the presence of true DEP, e.g. a JIT compiler for some language, which did not take care to warn the OS about the transitions between data access and execution.

According to Microsoft, SEHOP is again an OS-provided feature which does not depend upon how the binary was compiled.

There are buffer overflow "protection" techniques which can be seen by looking at the compiled code, e.g. the "canaries", because they rely on some extra checks which must be present in the produced code. Disassembling the code will reveal them, but inspection is tedious. Some other protections are purely compile-time, e.g. when the compiler warns about potentially unsafe usage of a printf()-like function -- there again, this kind of protection cannot be seen in the compiled executable.

share|improve this answer
1  
"regardless of how the executable and the DLL were compiled"? Are you sure about that? How are you going to relocate a DLL that was compiled without relocation information? (e.g. DLL compiled by MSVC with the /FIXED switch) Only relocatable binaries can be relocated. Obviously. Also, prior to Windows 8, only binaries that were especially marked, were ASLRed (in MSVC, by the /DYNAMICBASE switch). –  conio Dec 3 '12 at 1:24
add comment

For Windows binaries you might want to take a look at BinScope from Microsoft.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.