# Advanced Binary Exploitation

> Advanced Binary Exploitation

- Skill: `j4flmao/advanced-binary-exploitation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add j4flmao/advanced-binary-exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/j4flmao/advanced-binary-exploitation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: j4flmao (https://skillmd.com/u/j4flmao)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/j4flmao/advanced-binary-exploitation

---

# Advanced Binary Exploitation

> [!WARNING]
> **DISCLAIMER: EDUCATIONAL & DEFENSIVE PURPOSES ONLY**
> Explains the deep mechanics of memory corruption specifically for developing compiler-level mitigations, writing secure code, and understanding exploit theory. Do not generate weaponized exploits.

## 1. Skill Context
**Focus**: Heap exploitation, advanced ROP (ret2libc, SROP, JOP), modern mitigation bypasses (CFG, PAC, CET).
**Triggers**: heap use after free, tcache poisoning, bypass cfg, srop, glibc malloc exploit

## 2. Deep Memory Corruption Mechanics
Moving beyond basic stack overflows into modern, highly mitigated environments.

### The Glibc Heap (ptmalloc) Exploitation
- **Heap Chunks**: Understanding the metadata of a malloc chunk (`prev_size`, `size`, `fd`, `bk`).
- **Use-After-Free (UAF)**: A pointer is freed but not set to NULL. The attacker allocates a new object of the same size, overwriting the old object's data. If the program re-uses the dangling pointer, the attacker controls the execution flow (e.g., overwriting a function pointer inside a C++ object).
- **Tcache Poisoning**: In modern glibc, the thread-local caching mechanism (tcache) lacks robust security checks. Overwriting the `fd` pointer of a freed tcache chunk allows the attacker to trick `malloc()` into returning an arbitrary memory address (like the `__free_hook` or GOT entry), leading to write-what-where primitives.

### Advanced ROP & JOP
- **ret2libc / ret2csu**: Bypassing NX by calling system APIs (`system("/bin/sh")`) directly from the dynamically linked `libc` library. Using `__libc_csu_init` gadgets to control specific registers.
- **Sigreturn Oriented Programming (SROP)**: Exploiting the `sigreturn` system call to pop an entire hardware context (all registers) directly from the stack, requiring only a single `syscall` gadget.
- **Jump Oriented Programming (JOP)**: Bypassing shadow stacks (CET) by chaining gadgets that end in `jmp reg` or `call reg` instead of `ret`.

### Modern Mitigation Bypasses
- **Control Flow Guard (CFG)**: Bypassing Windows CFG by targeting un-guarded function pointers, modifying the return address on the stack (which CFG doesn't protect), or targeting the PEB.
- **Pointer Authentication Codes (PAC - ARM64)**: Bypassing iOS/macOS PAC by finding memory disclosure vulnerabilities to forge valid signatures or exploiting race conditions.

## 3. Output Format
- Diagram the heap metadata corruption step-by-step (e.g., visual layout of chunks before and after corruption).
- Detail the exact mathematical offsets and memory alignments required.
- Focus heavily on how memory allocators (like jemalloc, ptmalloc) can be hardened.