Ghidra: Stack cookies detecting and skipping

Created on 27 Mar 2019  路  3Comments  路  Source: NationalSecurityAgency/ghidra

For now it looks like this:
懈蟹芯斜褉邪卸械薪懈械

Is it possible to skip such variables at the start and the end of function?

Enhancement

Most helpful comment

Algo is simple: some global variable xored with SP. And in the end of function it does the same

All 3 comments

You mean detect stack cookies and omit them? That'd definitely be doable in a plugin as there's a nice metric for it, if at the function epilogue a data check is done against a variable on the stack.

But would be really nice to see this in core.

Algo is simple: some global variable xored with SP. And in the end of function it does the same

Maybe configure the address of the global it checks to avoid false positives

Was this page helpful?
0 / 5 - 0 ratings