We propose a binary rewriting system called Kimchi that modifies binary programs to protect them from format string attacks in runtime. Kimchi replaces the machine code calling conventional
with code calling a safer version of
, that prevents its format string from accessing arguments exceeding the stack frame of the parent function. With the proposed static analysis and binary rewriting method, it can protect binary programs even if they do not use the frame pointer register or link the
code statically. In addition, it reduces the performance overhead of the patched program by not modifying the calls to
with the format string argument located in the read-only memory segment, which are not vulnerable to the format string attack.