GS编译选项的文件为gs_support.c 这是源码
/***
*gs_support.c - initialize the global buffer overrun security cookie
*
* Copyright (c) Microsoft Corporation. All rights reserved.
*
*Purpose:
* Define __security_init_cookie, which is called at startup to initialize
* the global buffer overrun security cookie used by the /GS compile flag.
*
*******************************************************************************/
#include <Windows.h>
#if defined (_M_IX86) && defined (_CRTBLD) && defined (_DEBUG)
/*
* __security_init_cookie must be called before any exception handlers using
* the cookie are registered. We do a spot check for this condition in the
* debug version of the x86 CRT.
*/
#define CHECK_FOR_LATE_COOKIE_INIT
#define EXCEPTION_CHAIN_END ((struct _EXCEPTION_REGISTRATION_RECORD * POINTER_32)-1)
EXCEPTION_DISPOSITION __cdecl
_except_handler4(
IN struct _EXCEPTION_RECORD *ExceptionRecord,
IN PVOID EstablisherFrame,
IN OUT struct _CONTEXT *ContextRecord,
IN OUT PVOID DispatcherContext
);
#endif /* defined (_M_IX86) && defined (_CRTBLD) && defined (_DEBUG) */
/*
* Default value used for the global /GS security cookie, defined here and
* in gs_cookie.c (since standalone SDK build can't use CRT's internal.h).
*/
#ifdef _WIN64
#define DEFAULT_SECURITY_COOKIE 0x00002B992DDFA232
#else /* _WIN64 */
#define DEFAULT_SECURITY_COOKIE 0xBB40E64E
#endif /* _WIN64 */
/*
* The global security cookie. This name is known to the compiler.
*/
extern UINT_PTR __security_cookie;
extern UINT_PTR __security_cookie_complement;
/*
* Union to facilitate converting from FILETIME to unsigned __int64
*/
typedef union {
unsigned __int64 ft_scalar;
FILETIME ft_struct;
} FT;
/***
*__get_entropy() - retrieve entropy from the underlying OS.
*
*Purpose:
* Static helper to encapsulate entropy extraction from the OS.
* Combine a number of sources of randomness.
*
*Entry:
*
*Exit:
*
*Exceptions:
*
*******************************************************************************/
/*
* Enclaves initialize the stack cookie in the loader (similar to all
* modern platforms), but do not expose entropy. No attempt should be made
* to reinitialize the cookie by harvesting new entropy.
*/
#if defined (_SCRT_ENCLAVE_BUILD)
static UINT_PTR __get_entropy(void)
{
return DEFAULT_SECURITY_COOKIE;
}
#else
static UINT_PTR __get_entropy(void)
{
UINT_PTR cookie;
FT systime = { 0 };
LARGE_INTEGER perfctr;
GetSystemTimeAsFileTime(&systime.ft_struct);
#if defined (_WIN64)
cookie = systime.ft_scalar;
#else /* defined (_WIN64) */
cookie = systime.ft_struct.dwLowDateTime;
cookie ^= systime.ft_struct.dwHighDateTime;
#endif /* defined (_WIN64) */
cookie ^= GetCurrentThreadId();
cookie ^= GetCurrentProcessId();
#if _CRT_NTDDI_MIN >= NTDDI_VISTA
#if defined (_WIN64)
cookie ^= (((UINT_PTR)GetTickCount64()) << 56);
#endif /* defined (_WIN64) */
cookie ^= (UINT_PTR)GetTickCount64();
#endif /* _CRT_NTDDI_MIN >= NTDDI_VISTA */
QueryPerformanceCounter(&perfctr);
#if defined (_WIN64)
cookie ^= (((UINT_PTR)perfctr.LowPart << 32) ^ perfctr.QuadPart);
#else /* defined (_WIN64) */
cookie ^= perfctr.LowPart;
cookie ^= perfctr.HighPart;
#endif /* defined (_WIN64) */
/*
* Increase entropy using ASLR relocation
*/
cookie ^= (UINT_PTR)&cookie;
#if defined (_WIN64)
/*
* On Win64, generate a cookie with the most significant word set to zero,
* as a defense against buffer overruns involving null-terminated strings.
* Don't do so on Win32, as it's more important to keep 32 bits of cookie.
*/
cookie &= 0x0000FFFFffffFFFFi64;
#endif /* defined (_WIN64) */
return cookie;
}
#endif
/***
*__security_init_cookie() - init buffer overrun security cookie.
*
*Purpose:
* Initialize the global buffer overrun security cookie which is used by
* the /GS compile switch to detect overwrites to local array variables
* that potentially corrupt the return address. This routine is called
* at EXE/DLL startup.
*
*Entry:
*
*Exit:
*
*Exceptions:
*
*******************************************************************************/
void __cdecl __security_init_cookie(void)
{
UINT_PTR cookie;
/*
* Do nothing if the global cookie has already been initialized. On x86,
* reinitialize the cookie if it has been previously initialized to a
* value with the high word 0x0000. Some versions of Windows will init
* the cookie in the loader, but using an older mechanism which forced the
* high word to zero.
*/
if (__security_cookie != DEFAULT_SECURITY_COOKIE
#if defined (_M_IX86)
&& (__security_cookie & 0xFFFF0000) != 0
#endif /* defined (_M_IX86) */
)
{
__security_cookie_complement = ~__security_cookie;
return;
}
/*
* Initialize the global cookie with an unpredictable value which is
* different for each module in a process.
*/
cookie = __get_entropy();
/*
* Make sure the cookie is initialized to a value that will prevent us from
* reinitializing it if this routine is ever called twice.
*/
if (cookie == DEFAULT_SECURITY_COOKIE)
{
cookie = DEFAULT_SECURITY_COOKIE + 1;
}
#if defined (_M_IX86)
else if ((cookie & 0xFFFF0000) == 0)
{
cookie |= ( (cookie|0x4711) << 16);
}
#endif /* defined (_M_IX86) */
__security_cookie = cookie;
__security_cookie_complement = ~cookie;
}
要说的是 32位默认的值是0xBB40E64E 64位0x00002B992DDFA232
直接看反汇编也很明显
.text:004135E0 PerformanceCount= LARGE_INTEGER ptr -14h .text:004135E0 SystemTimeAsFileTime= _FILETIME ptr -0Ch .text:004135E0 var_4 = dword ptr -4 .text:004135E0 .text:004135E0 push ebp .text:004135E1 mov ebp, esp .text:004135E3 sub esp, 14h .text:004135E6 xor eax, eax .text:004135E8 mov [ebp+SystemTimeAsFileTime.dwLowDateTime], eax .text:004135EB mov [ebp+SystemTimeAsFileTime.dwHighDateTime], eax .text:004135EE lea ecx, [ebp+SystemTimeAsFileTime] .text:004135F1 push ecx ; lpSystemTimeAsFileTime .text:004135F2 call ds:GetSystemTimeAsFileTime .text:004135F8 mov edx, [ebp+SystemTimeAsFileTime.dwLowDateTime] .text:004135FB mov [ebp+var_4], edx .text:004135FE mov eax, [ebp+var_4] .text:00413601 xor eax, [ebp+SystemTimeAsFileTime.dwHighDateTime] .text:00413604 mov [ebp+var_4], eax .text:00413607 call ds:GetCurrentThreadId .text:0041360D xor eax, [ebp+var_4] .text:00413610 mov [ebp+var_4], eax .text:00413613 call ds:GetCurrentProcessId .text:00413619 xor eax, [ebp+var_4] .text:0041361C mov [ebp+var_4], eax .text:0041361F lea ecx, [ebp+PerformanceCount] .text:00413622 push ecx ; lpPerformanceCount .text:00413623 call ds:QueryPerformanceCounter .text:00413629 mov edx, [ebp+var_4] .text:0041362C xor edx, dword ptr [ebp+PerformanceCount] .text:0041362F mov [ebp+var_4], edx .text:00413632 mov eax, [ebp+var_4] .text:00413635 xor eax, dword ptr [ebp+PerformanceCount+4] .text:00413638 mov [ebp+var_4], eax .text:0041363B mov ecx, [ebp+var_4] .text:0041363E lea edx, [ebp+var_4] .text:00413641 xor ecx, edx .text:00413643 mov [ebp+var_4], ecx .text:00413646 mov eax, [ebp+var_4] .text:00413649 mov esp, ebp .text:0041364B pop ebp .text:0041364C retn .text:0041364C sub_4135E0 endp .text:0041364C
security_cookie 32位计算方式就是
- 获得 system time
- 与 GetCurrentProcessId() 异或
- 与 GetCurrentThreadId() 异或
- 与 GetTickCount() 异或
- 与 QueryPerformanceCounter()异或
64位的可以看原码大同小异
绕过方法也大同小异
1虚表，
2攻击seh,
3读到security_cookie，
4在运行前篡改security_cookie，
5劫持GetSystemTimeAsFileTime，
6，溢出1字节篡改security_cookie，在启动是就不会重新刷新cookie 第二次攻击就可以溢出
这里通过第三方劫持篡改security_cookie的值