binary-protection-bypass

A security-testing playbook for identifying and bypassing binary protection mechanisms in ELF binaries to enable exploitation in authorized settings such as CTF challenges and lab targets. It covers ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET shadow stack, and ARM MTE, pairing each protection with its bypass methods and the primitives those methods require. The material is distilled from CTF-wiki mitigation sections and real-world exploitation, and it emphasizes the combinatorial effect of multiple protections that base models often get wrong.

It begins with protection identification using checksec and readelf, then walks through each defense. For ASLR it lists information leaks, partial overwrites, brute force on 32-bit, return-to-PLT, ret2dlresolve, format-string leaks, and stack reading, along with an entropy table for stack, mmap/libc, heap, and PIE regions. PIE bypasses include leaks, partial overwrites, and relative addressing. NX/DEP coverage includes ROP, ret2libc, ret2csu, ret2dlresolve, SROP, mprotect chains, and JIT spray, with an example mprotect ROP chain.

RELRO coverage distinguishes no, partial, and full RELRO and lists alternative targets when the GOT is read-only, such as __malloc_hook, __free_hook, the _IO_FILE vtable, __exit_funcs, TLS_dtor_list, and .fini_array. Canary bypasses include format-string leaks, brute force on fork servers, thread canary overwrite, and GOT overwrite of __stack_chk_fail, and FORTIFY_SOURCE coverage addresses restrictions on fortified functions. The skill cross-references related routes for stack overflow and ROP, format-string exploitation, heap exploitation, and arbitrary-write-to-RCE, plus a protection-bypass matrix reference.