binary-hardening
Binary Hardening guides you through applying and validating security protections for C/C++ executables. Learn compiler and linker flags for RELRO, PIE, stack canaries, FORTIFY_SOURCE, and CFI, plus seccomp-bpf syscall filtering and hardware defenses like Intel CET and ARM BTI. Use checksec to audit existing binaries and confirm mitigations are in place.
Binary Hardening enables RELRO, PIE, stack canaries, FORTIFY_SOURCE, CFI, and seccomp protections for C/C++ builds.
AI-generated summary based on this skill's SKILL.md
Install
mohitmishra786/low-level-dev-skills/binary-hardening · repository language: JavaScript
git clone https://github.com/mohitmishra786/low-level-dev-skills
cp -r low-level-dev-skills/skills/runtimes/binary-hardening ~/.claude/skills/binary-hardeningnpx skillfed install mohitmishra786/low-level-dev-skills/binary-hardeningFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What does checksec output mean for binary security?
Binary Hardening's checksec tool analyzes compiled executables and reports on active protections. Output shows RELRO status (Full/Partial/None), PIE enablement, stack canary presence, NX bit, FORTIFY_SOURCE level, and CFI/CET support. Each protection reduces specific attack vectors—Full RELRO prevents GOT overwrites, PIE defeats address prediction, canaries catch stack smashing. Checksec helps you verify hardening flags actually took effect during compilation.
How do I enable RELRO PIE stack canaries with compiler flags?
Binary Hardening recommends these GCC/Clang flags for C/C++ builds: `-fPIE -pie` for Position Independent Executable, `-fstack-protector-strong` for stack canaries, `-z relro -z now` for full RELRO linking. Add `-D_FORTIFY_SOURCE=2` (or level 3) for buffer overflow checks. Combine them: `gcc -fPIE -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2 -z relro -z now source.c -o binary`. Run checksec on the result to confirm all protections activated.
How to harden C++ binary against exploits?
Binary Hardening applies layered defenses: compile with `-fPIE -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2 -z relro -z now` for memory layout randomization, stack overflow detection, and GOT hardening. Enable CFI with `-fsanitize=cfi` on Clang. On x86-64, add Intel CET flags (`-fcf-protection=full`) for shadow stack and indirect branch tracking. On ARM, use `-mbranch-protection=standard` for BTI/PAC. Validate with checksec, then add seccomp-bpf syscall filtering at runtime for defense-in-depth.
What is the difference between Full RELRO and Partial RELRO?
Binary Hardening distinguishes two RELRO modes: Partial RELRO (`-z relro`) marks the GOT read-only after dynamic linking completes, but the PLT remains writable. Full RELRO (`-z relro -z now`) resolves all symbols at startup and makes both GOT and PLT immutable, eliminating GOT overwrite attacks entirely. Full RELRO costs slightly more startup time but provides stronger protection. Checksec reports which mode is active; production binaries should target Full RELRO.
How do I implement seccomp-bpf syscall filtering in applications?
Binary Hardening guides seccomp-bpf setup: load a BPF filter via `prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)` early in main(). Define an allowlist of safe syscalls (e.g., read, write, mmap, exit) and deny the rest with SECCOMP_RET_KILL_PROCESS. Use libseccomp for easier filter generation. Test with strace to confirm your app doesn't need blocked syscalls. Seccomp hardens against privilege escalation and limits exploit payload options when combined with other mitigations.
How do I enable Intel CET shadow stack and BTI on ARM?
Binary Hardening enables hardware CFI differently per architecture. On x86-64, add `-fcf-protection=full` (Clang/GCC 9+) to activate Intel CET shadow stack and indirect branch tracking. On ARM64, use `-mbranch-protection=standard` to enable Branch Target Identification (BTI) and Pointer Authentication Code (PAC). Both require compatible CPU and kernel support. Checksec reports CFI status. These defenses prevent ROP/JOP gadget chains and return-oriented attacks at the CPU level.
SKILL.md
rendered from the published skill — quoted content, verbatim
Binary Hardening
Purpose
Guide agents through enabling and verifying binary security mitigations: checksec analysis, compiler and linker hardening flags (RELRO, PIE, stack canaries, FORTIFY_SOURCE, CFI), hardware shadow stack, and seccomp-bpf syscall filtering for defense-in-depth.
Triggers
- "How do I harden my binary against exploits?"
- "How do I check what security mitigations my binary has?"
- "What does checksec output mean?"
- "How do I enable RELRO, PIE, and stack canaries?"
- "How do I use seccomp to restrict syscalls?"
- "How do I enable CFI (control flow integrity)?"
Workflow
1. Analyze existing binary with checksec
```bash
Install checksec
pip install checksec.py # or: apt install
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 2 files
skills/runtimes/binary-hardening/SKILL.md
skills/runtimes/binary-hardening/references/hardening-flags.md