Skip to content

Strip stack canary boilerplate from decompiled output #161

@kumarak

Description

@kumarak

Problem

Compiler-inserted stack canary code adds noise to decompiled output:

// Entry:
local_58 = ___stack_chk_guard;

// Exit:
if (local_58 - ___stack_chk_guard != 0) {
    __stack_chk_fail(&__stack_chk_guard, 0, local_58 - ___stack_chk_guard);
}

This is compiler-generated security boilerplate, not user code. It obscures the actual function logic.

Root Cause

No detection or removal of the stack protection pattern exists in the pipeline. The `___stack_chk_guard` global load, the comparison, and the `__stack_chk_fail` call are all emitted as regular statements.

Proposed Fix

In `FunctionBuilder::create_basic_block()` or `create_operation()`:

  1. Detect operations referencing globals named `___stack_chk_guard` or `__stack_chk_guard`
  2. Detect CALL operations targeting `__stack_chk_fail`
  3. Skip emitting the associated statements (the entry LOAD, the exit comparison, and the fail call)
  4. Also skip the local variable declaration for the canary temp

Alternative simpler approach: Add `__stack_chk_fail` and `___stack_chk_guard` to `IGNORED_NAMES` in PcodeSerializer.java to suppress at serialization time.

Files

  • `lib/patchestry/AST/FunctionBuilder.cpp`
  • `lib/patchestry/AST/OperationStmt.cpp`
  • `scripts/ghidra/util/PcodeSerializer.java` (IGNORED_NAMES set)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions