[iOS] MASVS v2 MASVS-CODE-4 - Stack Canary

[Azulath]

It seems like there is a different output of the stack canary settings for otool and radate2:

~/❯ otool -Iv DamnVulnerableIOSApp | grep stack 
0x001d7edc   255 ___stack_chk_fail
0x001d8220   255 ___stack_chk_fail
0x001d8350   256 ___stack_chk_guard
0x0000000100089120   252 ___stack_chk_fail
0x00000001001e4120   253 ___stack_chk_guard
0x00000001001e4620   252 ___stack_chk_fail

~/ ❯ r2 DamnVulnerableIOSApp
 -- Sorry, radare2 has experienced an internal error.
[0x0001c0d0]> i~pic,canary
canary   false
pic      true

Many stackoverflow answers recommend otool to check the canary, but according to otool everything is fine while radare2 disagrees. Any recommendations on how to check properly or who do trust in this regard?

Edit: While Swift apps are memory save by design, I assume even a Swift app might run into issues when it fails this check as certain libraries used by the app might be written in Objective-C.

[cpholguera]

Thanks @Azulath! That's a very good question for @trufae, let me ping him.

[trufae]

Which version of r2 is this? Git one should be good afaik

[Azulath]

Thanks for the help! I am using this version. (This should be the one that homebrew distributes):

~/❯ r2 -v
radare2 5.8.8 0 @ darwin-x86-64
birth: git.5.8.8 2023-06-08__13:54:42
commit: 5.8.8
options: gpl release -O1 cs:5 cl:2 make

~/ ❯ r2 -V
5.8.8  r2
5.8.8  r_anal
5.8.8  r_lib
5.8.8  r_egg
5.8.8  r_asm
5.8.8  r_bin
5.8.8  r_cons
5.8.8  r_flag
5.8.8  r_core
5.8.8  r_crypto
5.8.8  r_bp
5.8.8  r_debug
5.8.8  r_main
5.8.8  r_fs
5.8.8  r_io
5.8.8  r_magic
5.8.8  r_parse
5.8.8  r_reg
5.8.8  r_sign
5.8.8  r_search
5.8.8  r_syscall
5.8.8  r_util

[trufae]

Yes that was a bug in that specific release. I should make a new release soon or late but if thats not a blocker for you I would recommend you to use the version from git:

1$ r2 DVIA-v2
WARN: Relocs has not been applied. Please use `-e bin.relocs.apply=true` or `-e bin.cache=true` next time
 -- Thank you for using radare2. Have a nice night!
[0x1001a9790]> i~pic,canary
canary   true
pic      true
[0x1001a9790]> ?V
radare2 5.8.9 34177 @ darwin-arm-64
birth: git.5.8.8-1001-g2886e84d73 2024-01-04__17:15:16
commit: 2886e84d73cde5c8a8b2d4661eb20e99be1493df
options: gpl -O2 cs:5 cl:2 make
[0x1001a9790]>

[Azulath]

Installing the git version on my macbook is a bit of a hassle since it is the company's and we cannot install software of our choosing. (I could create a ticket for it though.)

Any idea on when you will come around to publish those changes?