## 4 Canary Leakage POC Generation
### Canary Leakage Forger  
The canary leakage forger aims to construct an execution state that can leak the desired canary. It consists of two components, namely activation record analysis and output stream analysis. Each time a procedure in the target program is invoked, a new activation record is allocated on the stack region, keeping storage for the local variables, caller's return address, caller's stack base pointer, and the runtime canary imposed by StackGuard. When the control flow returns to the caller from this function, the activation record is removed. The activation record analysis component keeps track of the structure information for all currently alive activation records in \(\theta:\{<base,top,canary>|base\in\mathbb{Z},top\in\mathbb{Z},\)\(canary\in\mathbb{Z}\}\), among which a single triple \(<base,top,canary>\) represents a single activation record, with \(base\) and \(top\) denoting the base address and top address of the activation record region on the stack, \(canary\) denoting the address on the stack frame where the stored \begin{table}
\begin{tabular}{c c c} \hline \hline
**Name** & **Level** & **Hooking Semantics** \\ \hline onMemRead & instruction execution & A memory read operation is performed \\ \hline onMemWrite & instruction execution & A memory write operation is performed \\ \hline onRegRead & instruction execution & A register read operation is performed \\ \hline onRegWrite & instruction execution & A register write operation is performed \\ \hline onInstructionStart & instruction execution & An instruction begins to execute \\ \hline onInstructionEnd & instruction execution & An instruction finishes its execution \\ \hline onBlockStart & instruction execution & A basic block begins to execute \\ \hline onBlockEnd & instruction execution & A basic block finishes its execution \\ \hline onFunctionStart & instruction execution & A function begins to execute \\ \hline onFunctionRet & instruction execution & A function finishes its execution \\ \hline onModuleLoad & operating system & A module is loaded into the address space of the target process \\ \hline onModuleUnload & operating system & A module is unloaded into the address space of the target process \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Instrumentation interfaces. canary resides in. By installing hooks on instrumentation interfaces listed in Table 1, these values are calculated dynamically. The output stream analysis monitors the output events that happened along the execution trace by arranging hooks at the entry points of output API functions, trying to derive an execution state that can leak the desired canary. It completes the state derivation through two methods: one for activation record restoration and the other for symbolic output buffer manipulation. Formula (1) demonstrates an example of operation semantics of activation record restoration at the entry point of the Posix write function. Note that we describe the operation semantics in the same way as [32]. When the write function is invoked in the form \(write(fd,buf,sz)\), the activation record restoration method firstly checks if fd points to the desired information leaking channel. If so, it locates the activation record sf where buf resides in, and ensures that memory region \(\mu[buf,sf.canary]\) is filled with symbolic variables. It then checks the mathematical relationship among the symbolic variables in memory region \(\mu[buf,sf.canary]\). If some affine relationship is discovered [33], the activation record restoration method truncates the original symbolic content sequence \(\delta\) to \(\delta|_{\{0,\ldots,n\}}\), where \(n\) is the maximum index of symbolic variables in \(\mu[buf,sf.canary-1]\). In this way, the canary leakage state \(<\Sigma,\mu,\Delta,\Pi,\delta|_{\{0,\ldots,n\}}>\) is immediately derived.