There are also several other mitigation techniques that have been introduced to protect against exploitation. We will just mention a few of them:
- Stack canaries (/GS Cookies): This technique involves writing a 4 byte value just before the return address that will be checked before executing the ret instruction. This technique makes it very hard for the attackers to use stack overflow vulnerabilities in order to modify the return address as this value is unknown to them. However, there are multiple bypasses for it, and one of them is overwriting the SEH address and forcing an exception to happen before the check of the GS cookie occurs. Overwriting the SEH address is very effective, and led to other mitigations being introduced for it.
- SafeSEH and SEHOP: These two mitigations directly protect the applications from memory corruptions that overwrite SEH addresses. They are used for 32-bit and 64-bit systems. The SEH addresses are no longer stored in the stack...