{"enrichment":{"faq":[{"a":"Binary Hardening's checksec tool analyzes compiled executables and reports on active protections. Output shows RELRO status (Full/Partial/None), PIE enablement, stack canary presence, NX bit, FORTIFY_SOURCE level, and CFI/CET support. Each protection reduces specific attack vectors\u2014Full RELRO prevents GOT overwrites, PIE defeats address prediction, canaries catch stack smashing. Checksec helps you verify hardening flags actually took effect during compilation.","q":"What does checksec output mean for binary security?"},{"a":"Binary Hardening recommends these GCC/Clang flags for C/C++ builds: `-fPIE -pie` for Position Independent Executable, `-fstack-protector-strong` for stack canaries, `-z relro -z now` for full RELRO linking. Add `-D_FORTIFY_SOURCE=2` (or level 3) for buffer overflow checks. Combine them: `gcc -fPIE -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2 -z relro -z now source.c -o binary`. Run checksec on the result to confirm all protections activated.","q":"How do I enable RELRO PIE stack canaries with compiler flags?"},{"a":"Binary Hardening applies layered defenses: compile with `-fPIE -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2 -z relro -z now` for memory layout randomization, stack overflow detection, and GOT hardening. Enable CFI with `-fsanitize=cfi` on Clang. On x86-64, add Intel CET flags (`-fcf-protection=full`) for shadow stack and indirect branch tracking. On ARM, use `-mbranch-protection=standard` for BTI/PAC. Validate with checksec, then add seccomp-bpf syscall filtering at runtime for defense-in-depth.","q":"How to harden C++ binary against exploits?"},{"a":"Binary Hardening distinguishes two RELRO modes: Partial RELRO (`-z relro`) marks the GOT read-only after dynamic linking completes, but the PLT remains writable. Full RELRO (`-z relro -z now`) resolves all symbols at startup and makes both GOT and PLT immutable, eliminating GOT overwrite attacks entirely. Full RELRO costs slightly more startup time but provides stronger protection. Checksec reports which mode is active; production binaries should target Full RELRO.","q":"What is the difference between Full RELRO and Partial RELRO?"},{"a":"Binary Hardening guides seccomp-bpf setup: load a BPF filter via `prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)` early in main(). Define an allowlist of safe syscalls (e.g., read, write, mmap, exit) and deny the rest with SECCOMP_RET_KILL_PROCESS. Use libseccomp for easier filter generation. Test with strace to confirm your app doesn't need blocked syscalls. Seccomp hardens against privilege escalation and limits exploit payload options when combined with other mitigations.","q":"How do I implement seccomp-bpf syscall filtering in applications?"},{"a":"Binary Hardening enables hardware CFI differently per architecture. On x86-64, add `-fcf-protection=full` (Clang/GCC 9+) to activate Intel CET shadow stack and indirect branch tracking. On ARM64, use `-mbranch-protection=standard` to enable Branch Target Identification (BTI) and Pointer Authentication Code (PAC). Both require compatible CPU and kernel support. Checksec reports CFI status. These defenses prevent ROP/JOP gadget chains and return-oriented attacks at the CPU level.","q":"How do I enable Intel CET shadow stack and BTI on ARM?"}],"shadow_tags":["exploit-mitigation","compiler-flags","memory-safety","syscall-filtering","cpu-features","verification-tools","defense-in-depth","architecture-specific"],"summary_rewrite":"Binary Hardening guides you through applying and validating security protections for C/C++ executables. Learn compiler and linker flags for RELRO, PIE, stack canaries, FORTIFY_SOURCE, and CFI, plus seccomp-bpf syscall filtering and hardware defenses like Intel CET and ARM BTI. Use checksec to audit existing binaries and confirm mitigations are in place."},"files":[{"bytes":7986,"path":"skills/runtimes/binary-hardening/SKILL.md","sha256":"49465ebe25702d5c75ae8f18b9df827d6186bcfef62b0b7d3aeb0f5e8c923408","url":"https://skillfed.io/files/mohitmishra786/low-level-dev-skills/binary-hardening/8d5f3add/SKILL.md"}],"id":"mohitmishra786/low-level-dev-skills/binary-hardening","links":{"html":"https://skillfed.io/mohitmishra786/low-level-dev-skills/binary-hardening","md":"https://skillfed.io/mohitmishra786/low-level-dev-skills/binary-hardening.md","repo":"https://github.com/mohitmishra786/low-level-dev-skills"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":19,"language":"JavaScript","last_updated":"2026-06-27","license":"MIT","name":"binary-hardening","publisher":"mohitmishra786","stars":148},"relations":{"similar":[{"id":"mohitmishra786/low-level-dev-skills/kernel-security"},{"id":"yaklang/hack-skills/binary-protection-bypass"},{"id":"mohitmishra786/low-level-dev-skills/linkers-lto"},{"id":"mohitmishra786/low-level-dev-skills/elf-inspection"},{"id":"mohitmishra786/low-level-dev-skills/clang"},{"id":"mohitmishra786/low-level-dev-skills/sanitizers"},{"id":"mohitmishra786/low-level-dev-skills/pgo"},{"id":"mohitmishra786/low-level-dev-skills/gcc"},{"id":"mohitmishra786/low-level-dev-skills/linux-perf"},{"id":"mohitmishra786/low-level-dev-skills/build-acceleration"}]},"slug":{"owner":"mohitmishra786","repo":"low-level-dev-skills","skill":"binary-hardening"},"version":"8d5f3add"}