binary-protection-bypass
Master the identification and circumvention of modern binary protections including ASLR, PIE, NX/DEP, stack canaries, RELRO, FORTIFY_SOURCE, CET, and MTE. This playbook pairs each protection mechanism with its bypass methods and required primitives, drawing from real-world exploitation and CTF techniques. Learn information leaks, ROP chains, ret2libc, and alternative targeting strategies when standard approaches are blocked.
Binary Protection Bypass teaches techniques to identify and circumvent ASLR, PIE, NX, canaries, RELRO, and other ELF protections.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/binary-protection-bypass · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/binary-protection-bypass ~/.claude/skills/binary-protection-bypassnpx skillfed install yaklang/hack-skills/binary-protection-bypassFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to bypass ASLR in binary exploitation?
binary-protection-bypass teaches multiple ASLR circumvention strategies. Information leaks are the primary method—format string vulnerabilities, heap spraying, or side-channel attacks reveal base addresses at runtime. Once leaked, ROP chains and ret2libc techniques use absolute addresses to chain gadgets or call library functions. Partial overwrites exploit predictable lower bits when full randomization fails. Brute-force approaches work on systems with limited entropy or fork-based servers where the address space remains fixed across restarts.
What are PIE position independent executable bypass techniques?
binary-protection-bypass covers PIE bypass by combining information leaks with gadget discovery. Since PIE randomizes the binary base, leaking any code pointer reveals the offset. Format strings, heap overflows, or use-after-free bugs extract addresses from memory. Once the binary base is known, ROP gadgets are relocated and chained. Ret2libc remains effective if libc addresses are leaked separately. One-gadget ROP chains minimize the number of gadgets needed when full control is constrained.
NX DEP stack protection bypass ROP chains?
binary-protection-bypass details NX/DEP bypass through Return-Oriented Programming (ROP) and ret2libc. ROP chains string together short code sequences (gadgets) ending in `ret` to execute arbitrary logic without injecting shellcode. Ret2libc calls library functions like `mprotect()` to mark stack regions executable, then jumps to injected code. Both techniques require gadget discovery, address leaking (especially under ASLR), and careful stack frame construction. The playbook pairs each bypass with required primitives and real CTF examples.
How do stack canary leaking and brute force methods work?
binary-protection-bypass explains canary bypass via information leaks and brute force. Format string vulnerabilities or buffer over-reads leak the canary value from the stack. Brute-force techniques exploit fork-based servers where the canary remains constant across connections—each failed attempt reveals one byte until the full value is recovered. Partial overwrites target specific bytes when the canary is partially known. These primitives enable stack overflow exploitation even with canary protection enabled.
What protections does binary-protection-bypass cover?
binary-protection-bypass addresses ASLR, PIE, NX/DEP, stack canaries, RELRO (full and partial), FORTIFY_SOURCE, CET shadow stacks, and ARM MTE memory tagging. Each protection is paired with identification methods (checksec), bypass techniques, and required exploitation primitives. The playbook emphasizes real-world CTF and vulnerability research approaches, including GOT hijacking, ret2dlresolve dynamic linker attacks, and one-gadget ROP chains for constrained scenarios.
How does binary-protection-bypass help identify ELF security?
binary-protection-bypass teaches ELF binary security analysis using checksec and manual inspection. Identify which protections are enabled (ASLR, PIE, canaries, RELRO, NX) to determine viable bypass routes. The playbook maps each protection to its bypass methods and required primitives, enabling attackers to select the most practical exploitation path. Understanding the full protection stack guides information leak strategy, gadget selection, and chain construction for successful exploitation.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: Binary Protection Bypass — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert binary protection identification and bypass techniques. Covers ASLR, PIE, NX, RELRO, canary, FORTIFY_SOURCE, stack clash, CET shadow stack, and ARM MTE. Each protection is paired with its bypass methods and required primitives. Distilled from ctf-wiki mitigation sections and real-world exploitation. Base models often confuse which protections block which attacks and miss the combinatorial effect of multiple protections.
0. RELATED ROUTING
- stack-overflow-and-rop — ROP chains to bypass NX, ret2libc for ASLR bypass
- format-string-exploitation — primary method for leaking canary, PIE, libc addresses
-
heap-exploitation — heap attacks for RELRO bypass (when GOT is read-only)
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 2 files
skills/binary-protection-bypass/PROTECTION_BYPASS_MATRIX.md
skills/binary-protection-bypass/SKILL.md