400570: mov rdx,QWORD PTR [rbp-0x8] 400574: xor rdx,QWORD PTR fs:0x28 40057b: 00 00 40057d: je 400584 <main+0x3e> 40057f: call 400420 <__stack_chk_fail@plt>
The stack canary is stored in [RBP – 0x8]. So, this value is moved to RDX. Then, we are checking whether the stored value is unchanged and is equal to fs:0x28. If the value changes, we call __stack_chk_fail@plt which notifies the stack frame is corrupted.






0 Comments