Binary Protection Bypass
Upstream reference: yaklang/hack-skills/binary-protection-bypass — facts/tables distilled from ctf-wiki.
Final user-facing summary in Vietnamese.
0. Authorization & routing
Operates under MASTER_POLICY.md §1-§2.
1. Identification
# Linux / WSL
checksec --file=./binary
readelf -h ./binary | grep Type # PIE if Type: DYN
readelf -l ./binary | grep -E 'GNU_(STACK|RELRO)'
cat /proc/sys/kernel/randomize_va_space # 0/1/2 = off/partial/full
# Windows — use checksec.exe inside a Linux WSL or analyse PE separately
wsl checksec --file=./binary
| Mitigation |
Quick check |
Build flag that turns it on |
| ASLR |
cat /proc/sys/kernel/randomize_va_space |
OS-level |
| PIE |
readelf -h → Type: DYN |
-pie -fPIE |
| NX |
readelf -l → no RWE segment |
default since GCC 4.6 |
| Canary |
symbol __stack_chk_fail |
-fstack-protector-strong |
| Partial RELRO |
GNU_RELRO segment, .got.plt writable |
-Wl,-z,relro |
| Full RELRO |
.got read-only after load |
-Wl,-z,relro,-z,now |
| FORTIFY |
symbols __printf_chk, __memcpy_chk |
-D_FORTIFY_SOURCE=2 |
| CET |
NT_GNU_PROPERTY IBT/SHSTK |
-fcf-protection=full |
| MTE (ARM64) |
HWCAP2_MTE at runtime |
hardware-dependent |
2. Mitigation × bypass primitive
| Mitigation |
Defeats |
Required primitive |
Common technique |
| ASLR |
Hardcoded libc addresses |
Read primitive |
Format-string %N$p, leak via puts(GOT) |
| PIE |
Hardcoded .text addresses |
Read primitive OR partial overwrite (12 low bits fixed per page) |
leak from saved RIP; or 1-2 byte overwrite for 1/16 brute |
| NX |
Stack/heap shellcode |
Stack overflow |
ROP / ret2libc / ret2csu / ret2dlresolve / SROP |
| Stack canary |
Stack overflow |
Read past canary OR fork-server byte-by-byte oracle |
leak fs:[0x28]; child crashes reveal each byte |
| Partial RELRO |
GOT overwrite of .got.plt |
Write primitive |
Overwrite GOT entry of called function |
| Full RELRO |
GOT overwrite |
Heap / arbitrary write to writable hooks |
__free_hook / __malloc_hook; FILE struct attacks; tcache-poison |
| FORTIFY |
Bounded __printf_chk etc. |
n/a |
Find non-fortified call site; or attack via _chk argument count check |
| CET (IBT) |
Indirect calls without endbr target |
Find legit endbr gadgets |
Stay on endbr64 boundaries; SROP often ok |
| CET (Shadow stack) |
ret to non-shadowed addr |
Memory write into SS |
rare in CTF; usually skip arch where SS enabled |
| MTE |
Tag mismatch on UAF |
Tag oracle / brute force |
4-bit tag → 1/16 brute when reuse possible |
3. ASLR / PIE entropy on x86-64 Linux
| Region |
Entropy (bits) |
Slots |
| Stack |
22 |
~4M |
| mmap / libc |
28 |
~256M |
| Heap (brk) |
13 |
~8K |
| PIE base |
28 |
~256M |
Practical implication: brute force only viable on 32-bit or with reconnect oracles; otherwise need a leak.
4. ROP staples (defeat NX)
# pwntools — typical mprotect ROP to drop to shellcode
from pwn import *
exe = ELF('./vuln'); libc = exe.libc
r = process('./vuln')
pop_rdi = 0x401234 # find with ROPgadget --binary ./vuln
pop_rsi = 0x401236
pop_rdx = 0x401238
mprotect = libc.sym['mprotect']
shellcode = asm(shellcraft.sh(), arch='amd64')
page = 0x404000 # a writable page of the binary
chain = b'A' * 40
chain += p64(pop_rdi) + p64(page)
chain += p64(pop_rsi) + p64(0x1000)
chain += p64(pop_rdx) + p64(7) # PROT_RWX
chain += p64(mprotect)
chain += p64(page + 0x100) # jump to shellcode
r.sendline(chain)
r.send(b'\x00' * 0x100 + shellcode)
r.interactive()
Other NX-defeating routes: ret2libc(system, "/bin/sh"), ret2csu for arbitrary 3-arg calls without dedicated gadgets, SROP (one sigreturn gadget sets every register from a fake ucontext), ret2dlresolve (forge Elf64_Sym/Elf64_Rela to resolve arbitrary symbol).
5. Canary handling cheatsheet
| Scenario |
Technique |
| Format-string leak |
%N$lx until you see canary on stack (low byte always 0x00) |
| Read primitive |
read(stdout, &canary, 8) style; or arbitrary read |
| Fork server |
brute byte-by-byte; correct byte → child stays alive |
| Master canary |
leak from fs:[0x28] (TLS) or pthread's stack_guard field |
__stack_chk_fail hijack |
overwrite GOT of __stack_chk_fail (Partial RELRO) |
6. RELRO ladder
Partial RELRO → GOT.plt of called function still writable → classic GOT overwrite
Full RELRO → GOT read-only → pivot to writable hooks:
- __free_hook / __malloc_hook (glibc <2.34)
- exit_funcs / __exit_funcs (rtld_global)
- FILE vtable (_IO_FILE / _IO_jump_t) via fclose, exit, abort
- tcache poisoning → arbitrary write to next allocation
7. Methodology
- Run
checksec; record exact mitigation set.
- Find a read primitive — without one, ASLR/PIE/canary all stand. Format-string and OOB-read are common gifts.
- Find a write primitive sized for the target overwrite.
- Pick the bypass row in §2 matching primitive ↔ mitigation pair.
- Build the chain with
pwntools + ROPgadget/ropper.
- If multiple mitigations stack (e.g. PIE + canary + Full RELRO) you'll typically need two leaks (libc + PIE) and one robust write.
8. Tooling
| Tool |
Use |
checksec (pwn-tools) |
One-line mitigation listing |
pwntools |
ELF parsing, ROP chain builder, exploit dev |
ROPgadget, ropper |
Gadget search |
one_gadget |
Find single-call shells in libc |
LIEF |
Programmatic ELF rewriting |
angr (see symbolic-execution-tools) |
Auto-find leak path / compute constraints |
9. Vietnamese final summary template
🛡️ Phân tích & bypass mitigation:
📋 Mitigation set : <ASLR|PIE|NX|Canary|Full RELRO|FORTIFY|CET>
🔓 Leak primitive : <format-string %N$p | OOB read | UAF read>
✏️ Write primitive: <stack overflow | heap UAF | arbitrary write>
🔗 Chain : <ROP/ret2libc/ret2csu/SROP/ret2dlresolve>
📂 Exploit script : exploit.py
▶ Tiếp:
binary-patcher (vá vĩnh viễn) hoặc giữ exploit để chạy runtime.
ptn1411