# Exploit Development Concepts

> Exploit Development Concepts

- Skill: `j4flmao/exploit-development-concepts` (Agent Skill)
- Install (CLI): `npx skillmds@latest add j4flmao/exploit-development-concepts`
- Raw SKILL.md: https://api.skillmd.com/api/skills/j4flmao/exploit-development-concepts/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: j4flmao (https://skillmd.com/u/j4flmao)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/j4flmao/exploit-development-concepts

---

# Exploit Development Concepts

> [!WARNING]
> **DISCLAIMER: EDUCATIONAL & DEFENSIVE PURPOSES ONLY**
> This skill covers memory corruption theory to teach defensive programming and compiler-level mitigations. It does not generate actionable exploit scripts.

## 1. Skill Context
**Focus**: Memory corruption theory, x86/x64 architecture, and modern binary mitigations.
**Triggers**: buffer overflow mechanics, rop chain theory, bypass aslr, format string vulnerability

## 2. Low-Level Memory Mechanics
The agent must possess deep knowledge of assembly, CPU registers, and OS memory management.

### Stack-Based Buffer Overflow
- **Mechanics**: Writing more data to a stack-allocated buffer than it can hold, overwriting adjacent memory.
- **Execution**: The attacker overwrites the Instruction Pointer (`EIP`/`RIP`) or the saved Return Address on the stack to point to their injected shellcode.
- **Mitigation**: Stack Canaries (Cookies) which place a random value before the return address; the program crashes if the canary is modified.

### Return Oriented Programming (ROP)
- **Why it exists**: Introduced to bypass Data Execution Prevention (DEP / NX bit), which marks the stack and heap as non-executable.
- **Mechanics**: Instead of executing injected shellcode, the attacker hijacks the return address to execute existing snippets of executable code ending in a `ret` instruction ("gadgets") already present in the binary or loaded libraries (like `libc`).
- **Goal**: Chain gadgets together to call functions like `system("/bin/sh")` or `VirtualProtect()` to make the stack executable.

### ASLR (Address Space Layout Randomization)
- **Mechanics**: Randomizes the base addresses of the executable, heap, stack, and libraries upon every execution.
- **Bypass Theory**: Attackers use memory leaks (e.g., Format String vulnerabilities reading off the stack) to find a single pointer, calculate the randomization offset, and dynamically adjust their ROP chain addresses.

## 3. Output Format
- Diagram the memory layout (Stack/Heap structures) using ASCII art or Markdown tables.
- Explain the assembly instructions involved (`call`, `ret`, `push`, `pop`).
- Detail compiler-level mitigations (`-fstack-protector`, `PIE`, `RELRO`).