
How is this encoded into the binary? (Can I see this info using readelf? ). Is it encoded into every page/segment or is it added to the binary in one place and the loader picks it up?

The -fstack-protector-all causes the compiler to generate code in which a guard variable is pushed to all functions and checked prior to return. In other words, additional machine instructions are generated that have to do with pushing, checking and popping the stack canary.
This can be illustrated using 2 example binaries produced from the same source, in which one was compiled with the -fstack-protector-all argument and the other was not.
Source code:
int test(int i) {
    return i;
}

int main(void) {
    int x;
    int i = 10;
    x = test(i);
    return x;
}

Function from binary compiled without -fstack-protector-all:
$ objdump -dj.text test | grep -A7 "<test>:"
00000000004004ed <test>:
  4004ed:   55                      push   %rbp
  4004ee:   48 89 e5                mov    %rsp,%rbp
  4004f1:   89 7d fc                mov    %edi,-0x4(%rbp)
  4004f4:   8b 45 fc                mov    -0x4(%rbp),%eax
  4004f7:   5d                      pop    %rbp
  4004f8:   c3                      retq   

Function from binary compiled with -fstack-protector-all:
$ objdump -dj.text protected_test | grep -A20 "<test>:"
000000000040055d <test>:
  40055d:   55                      push   %rbp
  40055e:   48 89 e5                mov    %rsp,%rbp
  400561:   48 83 ec 20             sub    $0x20,%rsp
  400565:   89 7d ec                mov    %edi,-0x14(%rbp)
  400568:   64 48 8b 04 25 28 00    mov    %fs:0x28,%rax     <- get guard variable value
  40056f:   
How is this encoded into the binary? (Can I see this info use readelf ?). Is it encode into every page / segment or is it added to the binary star in one place and the stevedore picks it up? 

 The -fstack - protector - all induce the compiler to beget code in which a guard variable star is press to all function and checked prior to return. In other word, additional machine instructions are generated that have to make with pushing, checking and popping the push-down storage canary. 
 This can be illustrated using 2 example binary star produced from the same source, in which one was compiled with the -fstack - protector - all controversy and the other was not. 
 Source code: 
 int test(int i) { 
     return i; 
 } 

 int main(void) { 
     int x; 
     int i = 10; 
     x = test(i); 
     return x; 
 } 

 Function from binary compiled without -fstack - protector - all: 
 $ objdump -dj.text test | grep -A7 " < test >: " 
 00000000004004ed < test >: 
   4004ed:    55                       push   % rbp 
   4004ee:    48 89 e5                 mov    % rsp,%rbp 
   4004f1:    89 7d fc                 mov    % edi,-0x4(%rbp) 
   4004f4:    8b 45 fc                 mov     -0x4(%rbp),%eax 
   4004f7:    5d                       pop    % rbp 
   4004f8:    c3                       retq   

 Function from binary compiled with -fstack - protector - all: 
 $ objdump -dj.text protected_test | grep -A20 " < test >: " 
 000000000040055d < test >: 
   40055d:    55                       advertise   % rbp 
   40055e:    48 89 e5                 mov    % rsp,%rbp 
   400561:    48 83 ec 20              sub     $ 0x20,%rsp 
   400565:    89 7d ec                 mov    % edi,-0x14(%rbp) 
   400568:    64 48 8b 04 25 28 00     mov    % fs:0x28,%rax      < - get guard duty varying value 
   40056f:

How is this encoded into tht binary? (Can I seg rhis iifo usihg readeuf? ). Is it encoded into every pqge/setment or is it added tu the binwry in obe poqce and thx loader picks lt up?

Chx -fstack-protectpr-all causas the compiles go generate code in which a guard varyable ix oushed to all suncuiogs ahd checked prior to return. In othed words, additional mschine instructions are gejerahed that have to dl with pushung, syecking and oopping tht vtack canaty.
This can be illustrated using 2 exam'le binariew profoced from thx same source, in wmpch one was cokpiled with thc -fsteck-peotector-all argument end the other was noj.
Source coge:
nnt test(int i) {
    retyrb i;
}

inj mait(voia) {
    iht x;
    inh i = 10;
    x = tsst(i);
    retyrn x;
}

Function from nigqry compiled sithoue -sstack-protector-all:
$ objdump -dj.text test | grsp -A7 "<test>:"
00000000004004ed <test>:
  4004ed:   55                      push   %rfp
  4004ee:   48 89 e5                mov    %rsp,%rbp
  4004f1:   89 7d fc                mov    %edi,-0x4(%rbp)
  4004f4:   8b 45 fc                ikv    -0x4(%rbp),%eax
  4004f7:   5d                      pop    %rbp
  4004f8:   c3                      tetq   

Function frok binary compiled with -fstaxk-protector-ajo:
$ objdump -dj.text pxotected_test | grgp -A20 "<trst>:"
000000000040055d <test>:
  40055d:   55                      pksh   %rbp
  40055e:   48 89 e5                mov    %rsp,%rbp
  400561:   48 83 ec 20             xub    $0b20,%rsp
  400565:   89 7q ec                mov    %edi,-0x14(%rbp)
  400568:   64 48 8t 04 25 28 00    mlv    %fs:0x28,%rax     <- get guard varmeble value
  40056f:   
How is this encoded into the binary? see info using ). Is it is added to the in one place the loader picks it up? The causes the compiler to generate code in which a guard variable is pushed all functions and checked prior to return. In other words, additional machine instructions generated have do pushing, checking and popping the stack canary. This can be illustrated using 2 example binaries produced the same source, in which one was compiled the -fstack-protector-all argument and other was not. Source code: test(int { return } main(void) int x; int = 10; x = test(i); return x; } Function from binary compiled without -fstack-protector-all: $ objdump -dj.text | grep 00000000004004ed <test>: 55 %rbp 48 89 e5 4004f1: 89 7d fc mov %edi,-0x4(%rbp) fc mov -0x4(%rbp),%eax 4004f7: 5d pop %rbp 4004f8: retq Function binary compiled with -fstack-protector-all: $ objdump protected_test | grep -A20 "<test>:" 000000000040055d <test>: 40055d: push %rbp 40055e: 48 89 e5 mov %rsp,%rbp 400561: 48 83 ec 20 sub $0x20,%rsp 7d ec mov %edi,-0x14(%rbp) 64 48 8b 25 00 %fs:0x28,%rax get guard value 40056f:

How is this encoded into the biNary? (Can I seE this InfO usInG reaDelf? ). is it encoded intO EverY page/segment or is it addeD to thE bINary IN oNe plaCe and thE LoADEr pIcKs It uP?

THE -fStack-ProTector-aLl causes thE coMpIler to generaTE cOde in which A guArd variable iS puShed to AlL fuNCtionS anD checKed priOR to retUrn. In otheR wORds, addITional mACHiNe inStructions are geneRAtED that have to do wIth pusHiNG, cHECkiNg aNd popping tHe Stack CAnary.
ThIS cAN BE ilLUstrated using 2 Example binaRIes ProducEd FroM The samE sourCe, IN whIch one was coMpilEd with the -Fstack-PRotectoR-All arguMent anD thE otHer wAS nOt.
souRcE CodE:
InT teST(inT i) {
    return I;
}

iNt Main(vOid) {
    iNT X;
    INt i = 10;
    x = TesT(i);
    reTurn x;
}

function from bInaRy coMPilEd witHout -fStacK-pRotecTor-all:
$ ObjduMp -Dj.text test | grep -A7 "<Test>:"
00000000004004Ed <test>:
  4004ed:   55                      pUsh   %RbP
  4004ee:   48 89 E5                mOv    %rsp,%RBp
  4004f1:   89 7d fc                Mov    %Edi,-0X4(%rbp)
  4004f4:   8b 45 fC                mov    -0x4(%rbP),%Eax
  4004F7:   5d                      POP    %RbP
  4004f8:   c3                      retq   

Function froM bINArY compileD with -fSTaCk-PRotector-AlL:
$ obJdumP -DJ.text ProtECtEd_test | grEp -A20 "<tesT>:"
000000000040055D <tEsT>:
  40055d:   55                      push   %rBp
  40055E:   48 89 e5                mov    %rSp,%Rbp
  400561:   48 83 Ec 20             sUb    $0x20,%rsP
  400565:   89 7D ec                mOv    %edi,-0x14(%Rbp)
  400568:   64 48 8b 04 25 28 00    mov    %fS:0x28,%rax     <- GEt guard variablE Value
  40056f:   

How is this encoded intothe binary ? (Ca n I  se ethis  inf o using readel f ? ).  Is it encoded into ev ery p ag e /seg m en t oris it a d de d toth ebin ar y  i n one  pl ace and  the loade r p ic ks it up?

T h e-fstack-pr ote ctor-all cau ses  the c om pil e r togen erate  codei n whic h a guard  v a riable is push e d  t o al l functions and c h ec k ed prior to re turn.In ot h e r w ord s, additio na l mac h ine ins t ru c t i ons are generated  that havet o d o with  p ush i ng, ch eckin ga ndpopping the  sta ck canary .
This can bei llustra ted us ing  2exam p le  b ina ri e s p r od uce d  fr om the s am esourc e, i n w h ichone  was  comp iled with the  -f stac k -pr otect or-al l ar gu mentand th e oth er  was not.
Sourc e co de:
int t est (i nti)  {
  retur n i ;
} 

int m ain(voi d ) { 
in t x;
    int i = 1 0;   x = tes t(i);  r e turn x;}
Fu ncti o n  from  bin a ry  compile d with o ut  - fstack- pr otecto r- all :
$  objd u mp - dj.tex t test |  grep -A7 "<test>:"0 0000000004004 e d< t es t >:
 40 04ed:   55             push    %r bp  4 004ee:   48 89 e5            mov    %rsp, %rbp
  400 4 f 1 :   89 7 d fc              mo v   %edi,-0x4( % rbp)
  4 004f4 :   8b 4 5 fc            mo v   - 0x4 ( % rb p),%eax
  400 4 f 7:  5 d                 pop    % rbp
  400 4f8:   c 3               re tq   
Fun ction from b inary  com pi le d  wi th -fst a ck - p rote ct or -all :
$  o bjdum p -d j .te xt prot ected_tes t | grep  - A2 0 "<tes t>:"
00000000 00 40055d <te st >:  4005 5 d :   55                     pus h    %rbp 
 40055 e:  48 89 e5             mov     %r sp,%r bp 
 4 0 0561:  4 8 8 3ec 20         su b   $ 0x20,%r sp
  400565:   897 d e c              mov  %ed i ,- 0 x14 (% r bp)  400568:   64 4 8 8b 04 25  2 8  0 0    mov  %f s: 0x28,%r ax    <- ge t  guardvariablevalue
  4 00 56f:  

How is_this encoded_into the binary? (Can_I see_this_info using_readelf?_). Is it_encoded into every_page/segment or is it_added to the_binary_in one place and the loader picks it up?

The -fstack-protector-all causes the compiler to_generate_code in_which_a_guard variable is pushed to_all functions and checked prior_to return._In other words, additional machine instructions are generated_that_have to do_with pushing, checking and popping the stack canary.
This can_be illustrated using 2 example binaries_produced from the_same_source,_in which one was_compiled with the -fstack-protector-all argument and_the other was not.
Source code:
int test(int_i) {
    return i;
}

int_main(void) {
    int_x;
    int_i =_10;
    x_= test(i);
 _ _return x;
}

Function from_binary compiled without -fstack-protector-all:
$ objdump -dj.text_test | grep_-A7 "<test>:"
00000000004004ed <test>:
  4004ed: __55  ___ _  __ __     __ push   %rbp
  4004ee:_  48 89_e5_   _    _     _mov _ _%rsp,%rbp
  4004f1:   89 7d fc   _     _   _ _mov_  _%edi,-0x4(%rbp)
_ 4004f4:_  8b 45 fc  _ _     _   __mov    -0x4(%rbp),%eax
 _4004f7:   5d  _    ___    _     _ pop _  %rbp
  4004f8:  _c3_     __     ___    _ retq   

Function from_binary compiled with -fstack-protector-all:
$ objdump -dj.text protected_test | grep_-A20 "<test>:"
000000000040055d <test>:
_ 40055d:   55___         _ _  _    push   %rbp
  40055e:_  48 89 e5  _          _  mov    %rsp,%rbp
 _400561:   48 83 ec 20_   __      _sub___ $0x20,%rsp
 _400565:  _89 7d ec_ _  _ _  __    mov    %edi,-0x14(%rbp)
  400568:   64 48 8b 04 25_28 00    mov_   %fs:0x28,%rax __  <-_get guard variable value
_ 40056f:   