Stack Canary, ASLR, NX Bit, CFI — Mitigation-এর চার স্তর

# canary_sim.py -- extends the StackFrame model from memory-safety-buffer-overflow.mdx:
# insert a canary slot directly above the vulnerable buffer, below saved-rbp/return-address.
import struct

class CanaryFrame:
    """same StackFrame shape as the previous lesson, with one addition: an
    8-byte canary slot the compiler places directly above the local buffer --
    guaranteeing any linear overflow touches the canary BEFORE it can reach
    saved_rbp or return_address.
    offset 0..7   -> buf            (8 byte, local variable -- attacker's entry point)
    offset 8..15  -> canary         (8 byte, secret value, saved once at function entry)
    offset 16..23 -> saved_rbp      (8 byte)
    offset 24..31 -> return_addr    (8 byte)
    """
    def __init__(self, legit_return, canary_value):
        self.mem = bytearray(32)
        self.canary_value = canary_value
        self.mem[8:16] = struct.pack("<Q", canary_value)
        self.mem[24:32] = struct.pack("<Q", legit_return)

    @property
    def canary(self):
        return struct.unpack("<Q", self.mem[8:16])[0]

    @property
    def return_address(self):
        return struct.unpack("<Q", self.mem[24:32])[0]


def vulnerable_copy(frame, data: bytes):
    """strcpy-faithful: no bounds check, writes from offset 0 onward -- identical
    to the previous lesson's vulnerable_copy, just applied to a 32-byte frame now."""
    for i, b in enumerate(data):
        frame.mem[i] = b


def guarded_epilogue(frame):
    """what -fstack-protector inserts right before 'ret': compare the canary
    against the value saved at function entry. Mismatch -> abort, ret never runs."""
    if frame.canary != frame.canary_value:
        raise RuntimeError(
            f"*** stack smashing detected ***: canary mismatch "
            f"(expected={frame.canary_value:#018x}, found={frame.canary:#018x}) -- abort()"
        )
    return frame.return_address   # only reached if canary intact


PROCESS_CANARY = 0xdeadbeefcafe0000   # fixed here for reproducibility; a real canary is
                                       # random per-process (from /dev/urandom at startup)
                                       # and always carries a 0x00 byte to block string leaks
LEGIT_RETURN = 0x0000555555555169
ATTACKER_TARGET = 0x0000555555de0d0d

print(f"process canary (secret, saved once at entry) = {PROCESS_CANARY:#018x}")

print("\n--- scenario 1: normal-size write, canary untouched ---")
frame1 = CanaryFrame(LEGIT_RETURN, PROCESS_CANARY)
vulnerable_copy(frame1, b"A" * 8)
ret = guarded_epilogue(frame1)
print(f"epilogue passed, return_address = {ret:#018x}  (canary intact)")

print("\n--- scenario 2: the EXACT 24-byte payload that fully hijacked the")
print("    previous lesson's (canary-less) frame -- replayed against this frame ---")
old_payload = b"A" * 8 + b"B" * 8 + struct.pack("<Q", ATTACKER_TARGET)
frame2 = CanaryFrame(LEGIT_RETURN, PROCESS_CANARY)
vulnerable_copy(frame2, old_payload)
print(f"canary after overflow    = {frame2.canary:#018x}  (matches secret? {frame2.canary == PROCESS_CANARY})")
print(f"return_address after overflow = {frame2.return_address:#018x}  (still legit? {frame2.return_address == LEGIT_RETURN})")
try:
    ret = guarded_epilogue(frame2)
    print(f"epilogue passed -- should not happen! ret={ret:#018x}")
except RuntimeError as e:
    print(f"BLOCKED: {e}")

print("\n--- scenario 3: attacker adapts to the new layout, aims 32 bytes at")
print("    return_address, but does NOT know PROCESS_CANARY -- guesses zero ---")
guessed_canary = 0x0000000000000000
adapted_payload = (b"A" * 8 + struct.pack("<Q", guessed_canary) +
                    b"C" * 8 + struct.pack("<Q", ATTACKER_TARGET))
frame3 = CanaryFrame(LEGIT_RETURN, PROCESS_CANARY)
vulnerable_copy(frame3, adapted_payload)
print(f"return_address after overflow = {frame3.return_address:#018x}  (attacker-target? {frame3.return_address == ATTACKER_TARGET})")
try:
    ret = guarded_epilogue(frame3)
    print(f"epilogue passed -- hijack succeeded! ret={ret:#018x}")
except RuntimeError as e:
    print(f"BLOCKED: {e}")
print("-> return_address WAS successfully overwritten this time (32-byte payload")
print("   reaches it), but the canary check still fires first and aborts before")
print("   'ret' ever executes -- the overwritten value is never used.")

print("\n--- scenario 4: what a canary does NOT protect -- a heap-style region ---")
print("    (canaries are inserted only in STACK frames by -fstack-protector;")
print("     heap allocations get no canary at all)")
heap = bytearray(24)
struct.pack_into("<Q", heap, 16, 0x0000555555555169)   # e.g. a function pointer living on the heap
def heap_vulnerable_copy(mem, data):
    for i, b in enumerate(data):
        mem[i] = b
heap_payload = b"X" * 16 + struct.pack("<Q", ATTACKER_TARGET)
heap_vulnerable_copy(heap, heap_payload)
corrupted_fp = struct.unpack_from("<Q", heap, 16)[0]
print(f"heap function-pointer after overflow = {corrupted_fp:#018x}  (attacker-target? {corrupted_fp == ATTACKER_TARGET})")
print("-> corrupted silently. No canary exists here to check, no abort happens --")
print("   stack canary offers exactly zero protection outside the stack frame.")

প্রকৃত চালিয়ে পাওয়া output (deterministic — হুবহু এটাই আসবে):

process canary (secret, saved once at entry) = 0xdeadbeefcafe0000

--- scenario 1: normal-size write, canary untouched ---
epilogue passed, return_address = 0x0000555555555169  (canary intact)

--- scenario 2: the EXACT 24-byte payload that fully hijacked the
    previous lesson's (canary-less) frame -- replayed against this frame ---
canary after overflow    = 0x4242424242424242  (matches secret? False)
return_address after overflow = 0x0000555555555169  (still legit? True)
BLOCKED: *** stack smashing detected ***: canary mismatch (expected=0xdeadbeefcafe0000, found=0x4242424242424242) -- abort()

--- scenario 3: attacker adapts to the new layout, aims 32 bytes at
    return_address, but does NOT know PROCESS_CANARY -- guesses zero ---
return_address after overflow = 0x0000555555de0d0d  (attacker-target? True)
BLOCKED: *** stack smashing detected ***: canary mismatch (expected=0xdeadbeefcafe0000, found=0x0000000000000000) -- abort()
-> return_address WAS successfully overwritten this time (32-byte payload
   reaches it), but the canary check still fires first and aborts before
   'ret' ever executes -- the overwritten value is never used.

--- scenario 4: what a canary does NOT protect -- a heap-style region ---
    (canaries are inserted only in STACK frames by -fstack-protector;
     heap allocations get no canary at all)
heap function-pointer after overflow = 0x0000555555de0d0d  (attacker-target? True)
-> corrupted silently. No canary exists here to check, no abort happens --
   stack canary offers exactly zero protection outside the stack frame.

স্কেনারিও ২-এর ফলাফলটাই সবচেয়ে instructive: canary যোগ করার পরে, আগের লেসনের সেই একই ২৪-byte payload আর return address-কেই ছুঁতে পারছে না (still legit? True) — কারণ নতুন layout-এ canary এখন সেই জায়গায় বসে যেখানে আগে saved-rbp ছিল, আর payload-এর দৈর্ঘ্য তার বেশি যায়নি। তবু আক্রমণ ব্যর্থ হয়েছে, কারণ canary নিজেই ততক্ষণে corrupt হয়ে গেছে (matches secret? False) — guarded_epilogue সেটা ধরে ফেলেছে, ret পর্যন্ত পৌঁছানোর সুযোগই হয়নি। স্কেনারিও ৩ আরও কঠোর প্রমাণ দেয়: এবার payload ৩২ byte, return address সত্যিই সম্পূর্ণ ওভাররাইট হয়েছে (attacker-target? True) — তবু guarded_epilogue আটকে দিয়েছে, কারণ attacker-এর canary-অনুমান (0x0) আসল secret-এর সাথে মেলেনি। স্কেনারিও ৪ দেখায় ঠিক বিপরীত — canary-বিহীন একটা region-এ একই কৌশল সম্পূর্ণ নীরবে, কোনো বাধা ছাড়াই সফল হয়েছে।