diff --git a/tools/transforms/Rewrite_Utility.cpp b/tools/transforms/Rewrite_Utility.cpp
index ccbdbb9b56a5e4b6152991acc271992cb1d33900..131f3705f13694bbe0a7be874276e8a0ed90ae5a 100644
--- a/tools/transforms/Rewrite_Utility.cpp
+++ b/tools/transforms/Rewrite_Utility.cpp
@@ -352,10 +352,12 @@ Instruction_t* insertCanaryCheckBefore(FileIR_t* virp,Instruction_t *first, unsi
 
 	ss<<"cmp dword ["<<sp_reg;
 
+	bool esp_neg=false;
 	if(esp_offset <0)
 	{
 		ss<<"-";
 		esp_offset = esp_offset*-1;
+		esp_neg=true;
 	}
 	else
 		ss<<"+";
@@ -364,16 +366,48 @@ Instruction_t* insertCanaryCheckBefore(FileIR_t* virp,Instruction_t *first, unsi
 
 	//Insert the cmp before 
 	Instruction_t* next = insertAssemblyBefore(virp,first,ss.str());
+
 	//Then insert the jmp after the compare. 
 	//The fallthrough of the inserted jmp will be a copy of the original
 	//instruction, still pointed to by "first".
 	insertDataBitsAfter(virp,first,getJnzDataBits(),fail_code);
 	first->SetComment("Canary Check: "+first->GetComment());
 
+	//TODO: move canary zero to option 
+	if(esp_neg)
+		esp_offset *= -1;
+	insertCanaryZeroAfter(virp,first,esp_offset,fail_code); 
+
 	return next;
 
 }
 
+Instruction_t* insertCanaryZeroAfter(FileIR_t* virp, Instruction_t *first, int esp_offset, Instruction_t *fail_code)
+{
+	stringstream ss;
+	const char *sp_reg="esp";
+        if(virp->GetArchitectureBitWidth()==64)
+                sp_reg="rsp";
+
+        ss<<"mov dword ["<<sp_reg;
+
+        if(esp_offset <0)
+        {
+                ss<<"-";
+                esp_offset = esp_offset*-1;
+        }
+        else
+                ss<<"+";
+
+        ss<<"0x"<<hex<<esp_offset<<"], 0x0";
+
+        //Insert the cmp before 
+        Instruction_t* next = insertAssemblyAfter(virp,first,ss.str());
+        first->SetComment("Canary Zero: "+first->GetComment());
+
+        return next;
+}
+
 Relocation_t* createNewRelocation(FileIR_t* firp, Instruction_t* insn, string type, int offset)
 {
         Relocation_t* reloc=new Relocation_t;
diff --git a/tools/transforms/Rewrite_Utility.hpp b/tools/transforms/Rewrite_Utility.hpp
index b4b115c4645387a810bf319c4ab06ad2c94d3cea..9d34c4b7a3f3aafe8fcda16c22d56a8ace8a5e41 100644
--- a/tools/transforms/Rewrite_Utility.hpp
+++ b/tools/transforms/Rewrite_Utility.hpp
@@ -74,6 +74,7 @@ Instruction_t* getHandlerCode(FileIR_t* virp, Instruction_t* fallthrough, mitiga
 //Returns the pointer for the copied "first" instruction, which is at the
 //end of the canary check block of instructions. 
 Instruction_t* insertCanaryCheckBefore(FileIR_t* virp,Instruction_t *first, unsigned int canary_val, int ret_offset, Instruction_t *fail_code); 
+Instruction_t* insertCanaryZeroAfter(FileIR_t* virp, Instruction_t *first, int esp_offset, Instruction_t *fail_code);
 
 Relocation_t* createNewRelocation(FileIR_t* firp, Instruction_t* insn, string type, int offset);