binary-protection-bypass
starsforks
How to install binary-protection-bypass?
prohao42/aimy-skill/binary-protection-bypass
$npx -y skills add Prohao42/aimy-skill --skill binary-protection-bypassBinary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF binaries to enable exploitation.
SKILL.md
| 1 | # SKILL: Binary Protection Bypass — Expert Attack Playbook |
| 2 | |
| 3 | > **AI LOAD INSTRUCTION**: Expert binary protection identification and bypass techniques. Covers ASLR, PIE, NX, RELRO, canary, FORTIFY_SOURCE, stack clash, CET shadow stack, and ARM MTE. Each protection is paired with its bypass methods and required primitives. Distilled from ctf-wiki mitigation sections and real-world exploitation. Base models often confuse which protections block which attacks and miss the combinatorial effect of multiple protections. |
| 4 | |
| 5 | ## 0. RELATED ROUTING |
| 6 | |
| 7 | - [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md) — ROP chains to bypass NX, ret2libc for ASLR bypass |
| 8 | - [format-string-exploitation](../format-string-exploitation/SKILL.md) — primary method for leaking canary, PIE, libc addresses |
| 9 | - [heap-exploitation](../heap-exploitation/SKILL.md) — heap attacks for RELRO bypass (when GOT is read-only) |
| 10 | - [arbitrary-write-to-rce](../arbitrary-write-to-rce/SKILL.md) — what to overwrite when GOT is protected by RELRO |
| 11 | |
| 12 | ### Advanced Reference |
| 13 | |
| 14 | Load [PROTECTION_BYPASS_MATRIX.md](./PROTECTION_BYPASS_MATRIX.md) for comprehensive protection × bypass × primitive matrix. |
| 15 | |
| 16 | --- |
| 17 | |
| 18 | ## 1. PROTECTION IDENTIFICATION |
| 19 | |
| 20 | ```bash |
| 21 | $ checksec ./binary |
| 22 | [*] '/path/to/binary' |
| 23 | Arch: amd64-64-little |
| 24 | RELRO: Full RELRO ← GOT read-only |
| 25 | Stack: Canary found ← stack canary enabled |
| 26 | NX: NX enabled ← stack not executable |
| 27 | PIE: PIE enabled ← position-independent code |
| 28 | FORTIFY: Enabled ← fortified libc functions |
| 29 | ``` |
| 30 | |
| 31 | ### Quick Identification Table |
| 32 | |
| 33 | | Protection | Check Command | Binary Indicator | |
| 34 | |---|---|---| |
| 35 | | ASLR | `cat /proc/sys/kernel/randomize_va_space` | OS-level (0=off, 1=partial, 2=full) | |
| 36 | | PIE | `checksec` or `readelf -h` (Type: DYN) | Binary compiled with `-pie` | |
| 37 | | NX | `checksec` or `readelf -l` (no RWE segment) | `gcc -z noexecstack` (default on) | |
| 38 | | Canary | `checksec` or look for `__stack_chk_fail@plt` | `gcc -fstack-protector-all` | |
| 39 | | Partial RELRO | `readelf -l` (GNU_RELRO segment, `.got.plt` writable) | `gcc -Wl,-z,relro` | |
| 40 | | Full RELRO | `readelf -l` + `.got` section read-only | `gcc -Wl,-z,relro,-z,now` | |
| 41 | | FORTIFY | Presence of `__printf_chk`, `__memcpy_chk` etc. | `gcc -D_FORTIFY_SOURCE=2` | |
| 42 | |
| 43 | --- |
| 44 | |
| 45 | ## 2. ASLR BYPASS |
| 46 | |
| 47 | ASLR randomizes base addresses of stack, heap, libc, and mmap regions at each execution. |
| 48 | |
| 49 | | Bypass Method | Required Primitive | Notes | |
| 50 | |---|---|---| |
| 51 | | Information leak | Any read primitive (format string, OOB read, UAF) | Leak libc/stack/heap address → calculate base | |
| 52 | | Partial overwrite | Write primitive (limited length) | Overwrite last 1-2 bytes (page offset fixed) | |
| 53 | | Brute force (32-bit) | Ability to reconnect/retry | ~256–4096 attempts (8-12 bits entropy) | |
| 54 | | Return-to-PLT | Stack overflow | PLT addresses are at fixed offset from binary base (if no PIE) | |
| 55 | | ret2dlresolve | Stack overflow + write primitive | Resolve arbitrary function without knowing libc base | |
| 56 | | Format string leak | Format string vulnerability | `%N$p` for stack/libc/heap addresses | |
| 57 | | Stack reading | Byte-by-byte (fork server) | Read stack byte-by-byte via crash oracle | |
| 58 | |
| 59 | ### ASLR Entropy (x86-64 Linux) |
| 60 | |
| 61 | | Region | Entropy (bits) | Positions | |
| 62 | |---|---|---| |
| 63 | | Stack | 22 | ~4M | |
| 64 | | mmap / libc | 28 | ~256M | |
| 65 | | Heap (brk) | 13 | ~8K | |
| 66 | | PIE binary | 28 | ~256M | |
| 67 | |
| 68 | --- |
| 69 | |
| 70 | ## 3. PIE BYPASS |
| 71 | |
| 72 | PIE (Position Independent Executable) randomizes the binary's own code/data base address. |
| 73 | |
| 74 | | Bypass Method | Required Primitive | Notes | |
| 75 | |---|---|---| |
| 76 | | Information leak | Read return address from stack | PIE base = leaked_addr - known_offset | |
| 77 | | Partial overwrite | One-byte or two-byte write | Last 12 bits of page offset are fixed | |
| 78 | | Format string leak | Format string vulnerability | `%N$p` where N points to .text return address | |
| 79 | | Relative addressing | Knowledge of binary layout | If you know relative offsets, only need one leak | |
| 80 | |
| 81 | ### Partial Overwrite Details |
| 82 | |
| 83 | ``` |
| 84 | PIE binary loaded at: 0x555555554000 (example) |
| 85 | Function at offset 0x1234: 0x555555555234 |
| 86 | |
| 87 | Overwrite return address last 2 bytes: 0x?234 → 0x?XXX |
| 88 | Unknown: bits 12-15 (one nibble = 4 bits = 16 possibilities) |
| 89 | Success rate: 1/16 per attempt |
| 90 | ``` |
| 91 | |
| 92 | --- |
| 93 | |
| 94 | ## 4. NX / DEP BYPASS |
| 95 | |
| 96 | NX (No-eXecute) / DEP (Data Execution Prevention) prevents execution of code on the stack/heap. |
| 97 | |
| 98 | | Bypass Method | Detail | |
| 99 | |---|---| |
| 100 | | ROP (Return-Oriented Programming) | Chain existing code gadgets ending in `ret` | |
| 101 | | ret2libc | Call libc functions (system, execve) directly | |
| 102 | | ret2csu | Use `__libc_csu_init` gadgets for controlled function calls | |
| 103 | | ret2dlresolve | Forge dynamic linker structures to resolve arbitrary functions | |
| 104 | | SROP | Use sigreturn to set all registers from fake signal frame | |
| 105 | | mprotect ROP |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
