Hosting Provided By

Anyone looked at the canary stack protection in Win2k3?

From: Andrew Thomas <andrew(at)generator.co.za>
Date: Sun Jul 20 2003 - 06:37:03 EDT

I've looked a bit at a single disassembly that I got
(IDA Pro) of the package. It's quite cute that MS have
started creating a 'fix' to reduce the probability of programmatic errors in their code having as great an impact as they could.

Any comments on their canary generator? It seems to generate enough randomness, with use of: GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter

all nicely xor'ed together. But then again, I am not an expert in these matters.

--
Andrew G. Thomas
Hobbs & Associates Chartered Accountants (SA)

(o) +27-(0)21-683-0500

(f) +27-(0)21-683-0577


(m) +27-(0)83-318-4070

Received on Mon Jul 21 11:20:58 2003

This message: [ Message body ]
Next message: kathy tuckey: "Does IE object type overflow work only on an Administrator account?"
Previous message: noir: "RE: Named Pipe Impersonation -> CreateProcessAsUser();"
Next in thread: Mark Feldman: "Re: Anyone looked at the canary stack protection in Win2k3?"
Reply: Mark Feldman: "Re: Anyone looked at the canary stack protection in Win2k3?"

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ] [ By messages with attachments ]

This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:07:40 EDT