This paper presents a dynamic and transparent toolkit

SafeBird

to defend against run-time buffer overflows by combining several techniques.SafeBird consists of three tools:SIET

LibsafeXP and SLI.SIET extracts the size and starting address information of program global variables from the symbol section of ELF executable file.LibsafeXP

a dynamic shared library and an extension to Libsafe

contains wrapper functions for all the buffer related C Standard Library functions.These wrapper functions are enforced to check the source and target buffer’s size using the following information:global buffer knowledge provided by SIET

heap buffer knowledge by intercepting/tracking memory allocation family functions

and stack buffer bound information by dynamically determined from the frame pointer.The third tool SLI is used to accomplish the function interception and inject the shared library

LibsafeXP

into the running process online without interruption.Compared with existing approaches

SafeBird is more transparent to programs:it works on binary mode

and neither requires the source code or any debug information

nor needs to stop/restart the protected software.Performance and effectiveness evaluations indicate that SafeBird could be used to prevent run-time buffer overflow attacks efficiently

and imposes only about 10 percent overhead on average.