如何检测是否在iOS应用中启用了堆栈粉碎保护

Question

I want to be able to check if stack smashing protection (-fstack-protector-all) is enabled in an iOS app built on Xcode 9 with a target of iOS 11.

I built an app with -fstack-protector-all enabled in "Other C flags", and it does build and run, but how can I verify that stack smashing protection is enabled?

There are lots of older (2013 and earlier) resources out there that mention otool -Iv appName |grep stack_chk , but I ran that on my app binary and stack_chk was nowhere to be found in the output.

Is there a modern equivalent to that command? Is -fstack-protector-all even necessary anymore given the current set of defaults in Xcode?

Answer 1

You could check the generated code yourself. Compile with and without protection, then have a look at the disassembled code (for XCode you can use: View disassembly in XCode 4 (or Xcode 5 or Xcode 6) , or just use your favorite disassembler).

Samples of the generated code in both cases can be found here: https://security.stackexchange.com/questions/158609/how-is-the-stack-protection-enforced-in-a-binary?newreg=af786a3bcdc841e1b92110299a2951af

Last but not least, just try to write a small test of your own, which attempts to corrupt the stack. Once you are able to smash the stack, enable the protection flag, rebuild and see if it has any effect. Trivial examples can be found, of course, here: https://en.wikipedia.org/wiki/Stack_buffer_overflow

Answer 2

-fstack-protector-all is a valid option for llvm compiler used in Xcode, see for example http://lists.llvm.org/pipermail/cfe-dev/2017-April/053662.html . It is just poorly documented unfortunately.

For how to verify you can look at assembly generated with and without the option as suggested in the other answer or just compare the generated binaries size at first.