binary-protection-bypass
Master the identification and circumvention of modern binary protections including ASLR, PIE, NX/DEP, stack canaries, RELRO, FORTIFY_SOURCE, CET, and MTE. This playbook pairs each protection mechanism with its bypass methods and required primitives, drawing from real-world exploitation and CTF techniques. Learn information leaks, ROP chains, ret2libc, and alternative targeting strategies when standard approaches are blocked.
Binary Protection Bypass teaches techniques to identify and circumvent ASLR, PIE, NX, canaries, RELRO, and other ELF protections.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
Binary Protection Bypass teaches techniques to identify and circumvent ASLR, PIE, NX, canaries, RELRO, and other ELF protections. Master the identification and circumvention of modern binary protections including ASLR, PIE, NX/DEP, stack canaries, RELRO, FORTIFY_SOURCE, CET, and MTE. This playbook pairs each protection mechanism with its bypass methods and required primitives, drawing from real-world exploitation and CTF techniques. Learn information leaks, ROP chains, ret2libc, and alternative targeting strategies when standard approaches are blocked.
Use it when
- binary-protection-bypass covers PIE bypass by combining information leaks with gadget discovery.
- binary-protection-bypass details NX/DEP bypass through Return-Oriented Programming (ROP) and ret2libc.
Verify before relying
Read SKILL.md below before installing (2 files). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/binary-protection-bypass · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to bypass ASLR in binary exploitation?
binary-protection-bypass teaches multiple ASLR circumvention strategies. Information leaks are the primary method—format string vulnerabilities, heap spraying, or side-channel attacks reveal base addresses at runtime. Once leaked, ROP chains and ret2libc techniques use absolute addresses to chain gadgets or call library functions. Partial overwrites exploit predictable lower bits when full randomization fails. Brute-force approaches work on systems with limited entropy or fork-based servers where the address space remains fixed across restarts.
What are PIE position independent executable bypass techniques?
binary-protection-bypass covers PIE bypass by combining information leaks with gadget discovery. Since PIE randomizes the binary base, leaking any code pointer reveals the offset. Format strings, heap overflows, or use-after-free bugs extract addresses from memory. Once the binary base is known, ROP gadgets are relocated and chained. Ret2libc remains effective if libc addresses are leaked separately. One-gadget ROP chains minimize the number of gadgets needed when full control is constrained.
NX DEP stack protection bypass ROP chains?
binary-protection-bypass details NX/DEP bypass through Return-Oriented Programming (ROP) and ret2libc. ROP chains string together short code sequences (gadgets) ending in `ret` to execute arbitrary logic without injecting shellcode. Ret2libc calls library functions like `mprotect()` to mark stack regions executable, then jumps to injected code. Both techniques require gadget discovery, address leaking (especially under ASLR), and careful stack frame construction. The playbook pairs each bypass with required primitives and real CTF examples.
How do stack canary leaking and brute force methods work?
binary-protection-bypass explains canary bypass via information leaks and brute force. Format string vulnerabilities or buffer over-reads leak the canary value from the stack. Brute-force techniques exploit fork-based servers where the canary remains constant across connections—each failed attempt reveals one byte until the full value is recovered. Partial overwrites target specific bytes when the canary is partially known. These primitives enable stack overflow exploitation even with canary protection enabled.
What protections does binary-protection-bypass cover?
binary-protection-bypass addresses ASLR, PIE, NX/DEP, stack canaries, RELRO (full and partial), FORTIFY_SOURCE, CET shadow stacks, and ARM MTE memory tagging. Each protection is paired with identification methods (checksec), bypass techniques, and required exploitation primitives. The playbook emphasizes real-world CTF and vulnerability research approaches, including GOT hijacking, ret2dlresolve dynamic linker attacks, and one-gadget ROP chains for constrained scenarios.
How does binary-protection-bypass help identify ELF security?
binary-protection-bypass teaches ELF binary security analysis using checksec and manual inspection. Identify which protections are enabled (ASLR, PIE, canaries, RELRO, NX) to determine viable bypass routes. The playbook maps each protection to its bypass methods and required primitives, enabling attackers to select the most practical exploitation path. Understanding the full protection stack guides information leak strategy, gadget selection, and chain construction for successful exploitation.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: Binary Protection Bypass — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert binary protection identification and bypass techniques. Covers ASLR, PIE, NX, RELRO, canary, FORTIFY_SOURCE, stack clash, CET shadow stack, and ARM MTE. Each protection is paired with its bypass methods and required primitives. Distilled from ctf-wiki mitigation sections and real-world exploitation. Base models often confuse which protections block which attacks and miss the combinatorial effect of multiple protections.
0. RELATED ROUTING
- stack-overflow-and-rop — ROP chains to bypass NX, ret2libc for ASLR bypass
- format-string-exploitation — primary method for leaking canary, PIE, libc addresses
-
heap-exploitation — heap attacks for RELRO bypass (when GOT is read-only)
(truncated - see the full file via the links below)
File tree — 2 files
skills/binary-protection-bypass/PROTECTION_BYPASS_MATRIX.md
skills/binary-protection-bypass/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Learn how to identify and bypass modern binary protections for exploitation”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
CTF Binary Exploitation guides you through discovering and exploiting memory corruption vulnerabilities to read flags. Learn to analyze data flow, identify unsafe APIs, map memory layouts, and chain exploitation primitives—from buffer overflows to ROP chains—adapting core concepts to any pwn challenge.
This skill covers format string exploitation from vulnerability identification through advanced attack chains. Learn to read stack memory with %p, perform arbitrary writes using %n variants, leak canaries and ASLR offsets, and overwrite GOT entries or hooks for code execution. Includes pwntools automation and blind exploitation techniques.
Stack Overflow & ROP covers advanced control-flow hijacking via return address overwrite on Linux userland binaries. Learn buffer overflow fundamentals, libc leaking strategies, ROP gadget selection, ret2csu for multi-argument calls, ret2dlresolve for blind resolution, SROP for register control, and stack pivoting under constraints. Includes tool comparisons and real-world exploitation patterns.
ctf-pwn equips you with techniques to weaponize memory corruption vulnerabilities in CTF challenges. From buffer overflows and format strings to advanced heap exploitation, ROP chains, and kernel attacks, it covers the full spectrum of low-level privilege escalation and code execution paths. Use it when you have a vulnerable target and need to convert corruption primitives into shell access.
Binary Analysis guides you through reverse engineering workflows for CTF challenges and vulnerability research. It combines security property checks, static disassembly, firmware extraction, and dynamic debugging to uncover exploitable weaknesses and craft targeted payloads.
Build weaponized proof-of-concept exploits from confirmed vulnerabilities, constructing reliable primitive chains (leak → read/write → control flow) across userland binaries, browser engines, and kernel targets. Handles modern protections including ASLR, DEP, stack canaries, CFG, Intel CET, and V8 Sandbox with integrated OPSEC and detection telemetry.
More skills binary-hardening (MIT) · heap-exploitation (MIT) · sandbox-escape-techniques (MIT) · browser-exploitation-v8 (MIT)