As far as I understand, stack canaries work as fllows:
Upon program startup a random value is generated and stored
in the thread local storage (
%fs:0x28). This random value is then pushed onto the stack in each function call to be checked against later.
I have two questions regarding this "master-cookie" in the TLS area:
Where in this layout would is the thread local storage?
- When the process spawns a new thread, will the thread local storage (and, as a result, the stack canary value) be copied to that new thread? Or does the kernel generate a new stack canary value for each thread?