Abstract: Due to the lack of boundary checking mechanism of C/C++,buffer overflow is one of the most serious attacks caused by the unsafe functions,such as strcpy.This paper firstly discussed the current mechanism of libsafe lib-rary and analyzed the drawbacks using stack frame pointer to look back upon the stack information.We proposed a method through matching the attribute code of instruction’s opcode to look back upon the stack information.By ma-tching each opcode with the candidate opcode,we could get the stack information.We also introduced hash function to store the stack information that have been computed and the return address is used as key of the hash function.We analyzed the feasibility and complexity of our improvement algorithm.Experiments were done from different perspectives of cushion,integrity,accuracy.Performance shows the effectiveness of the algorithm.

Key words: Detection of Libsafe library,Stack frame pointer,Activate record,Attribute code of instruction,Look back upon stack,Hash function