Plain GS frames are pretty easy to find in disassembly. Plain GS frames look like:
sub esp, 16
mov eax, DWORD PTR ___security_cookie
xor eax, ebp|esp
mov DWORD PTR __$ArrayPad$[ebp|esp], eax
The scheduler can sometimes interleave some instructions in there. EH frames are quite a bit trickier to find if compiled for size however, because we use helper calls (like __EH_prolog3_GS) to setup/unlink the frames. But you could look for the helper code in the image (there are multiple versions to look for), and search for calls to it. Depending on coding styles though, GS frames can be pretty rare... Some code doesn't need stack buffers or local structs. So not finding one doesn't mean the code isn't compiled with /GS.
-- Louis Lafreniere