Analysis of GS protections in Windows Vista

The Visual Studio compiler supports a Buffer Security Check (GS) option to protect stack variables from overflows that resulted in arbitrary code execution. We developed techniques to identify the presence of GS protection in binaries and used them to identify which programs are and which programs are not protected by the GS option in the 32-bit RTM release of Windows Vista.

We also measured the randomness of the GS cookies and the affect of Address Space Layout Randomization (ASLR) on the placement of the master cookie.