How to detect if stack smashing protection is enabled in an iOS app

Question

I want to be able to check if stack smashing protection (-fstack-protector-all) is enabled in an iOS app built on Xcode 9 with a target of iOS 11.

I built an app with -fstack-protector-all enabled in "Other C flags", and it does build and run, but how can I verify that stack smashing protection is enabled?

There are lots of older (2013 and earlier) resources out there that mention otool -Iv appName |grep stack_chk, but I ran that on my app binary and stack_chk was nowhere to be found in the output.

Is there a modern equivalent to that command? Is -fstack-protector-all even necessary anymore given the current set of defaults in Xcode?

Boarfish

I have checked blank Swift apps in Xcode 9.2 and 9.3 and I can confirm that I am seeing no stack-related symbols. Other C flags should have no effect on Swift compiler swiftc - -fstack-protector-all should only work for the files compiled with clang. If otool/grep on the binary shows the presence of stack* symbols this does not mean they are coming from Swift files - they can come from C/Objective-C objects. I would guess that the absence of stack protection in Swift, at least if we decide based on absence of stack* symbols in the binary, is either intended or a regression. – Winder

Answer 1

You could check the generated code yourself. Compile with and without protection, then have a look at the disassembled code (for XCode you can use: View disassembly in XCode 4 (or Xcode 5 or Xcode 6), or just use your favorite disassembler).

Samples of the generated code in both cases can be found here: https://security.stackexchange.com/questions/158609/how-is-the-stack-protection-enforced-in-a-binary?newreg=af786a3bcdc841e1b92110299a2951af

Last but not least, just try to write a small test of your own, which attempts to corrupt the stack. Once you are able to smash the stack, enable the protection flag, rebuild and see if it has any effect. Trivial examples can be found, of course, here: https://en.wikipedia.org/wiki/Stack_buffer_overflow

Markos

Answer 2

-fstack-protector-all is a valid option for llvm compiler used in Xcode, see for example http://lists.llvm.org/pipermail/cfe-dev/2017-April/053662.html. It is just poorly documented unfortunately.

For how to verify you can look at assembly generated with and without the option as suggested in the other answer or just compare the generated binaries size at first.

Skid