Binary Protection Bypass

SKILL: Binary Protection Bypass — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert binary protection identification and bypass techniques. Covers ASLR, PIE, NX, RELRO, canary, FORTIFY_SOURCE, stack clash, CET shadow stack, and ARM MTE. Each protection is paired with its bypass methods and required primitives. Distilled from ctf-wiki mitigation sections and real-world exploitation. Base models often confuse which protections block which attacks and miss the combinatorial effect of multiple protections.

0. RELATED ROUTING

• stack-overflow-and-rop — ROP chains to bypass NX, ret2libc for ASLR bypass
• format-string-exploitation — primary method for leaking canary, PIE, libc addresses
• heap-exploitation — heap attacks for RELRO bypass (when GOT is read-only)
• arbitrary-write-to-rce — what to overwrite when GOT is protected by RELRO

Advanced Reference

Load PROTECTION_BYPASS_MATRIX.md for comprehensive protection × bypass × primitive matrix.

---

1. PROTECTION IDENTIFICATION

$ checksec ./binary
[*] '/path/to/binary'
    Arch:     amd64-64-little
    RELRO:    Full RELRO          ← GOT read-only
    Stack:    Canary found        ← stack canary enabled
    NX:       NX enabled          ← stack not executable
    PIE:      PIE enabled         ← position-independent code
    FORTIFY:  Enabled             ← fortified libc functions

Quick Identification Table

---

2. ASLR BYPASS

ASLR randomizes base addresses of stack, heap, libc, and mmap regions at each execution.

ASLR Entropy (x86-64 Linux)

---

3. PIE BYPASS

PIE (Position Independent Executable) randomizes the binary's own code/data base address.

Partial Overwrite Details

PIE binary loaded at: 0x555555554000 (example)
Function at offset 0x1234: 0x555555555234

Overwrite return address last 2 bytes: 0x?234 → 0x?XXX
Unknown: bits 12-15 (one nibble = 4 bits = 16 possibilities)
Success rate: 1/16 per attempt

---

4. NX / DEP BYPASS

NX (No-eXecute) / DEP (Data Execution Prevention) prevents execution of code on the stack/heap.

mprotect Chain

# Make stack executable, then jump to shellcode
rop = b'A' * offset
rop += p64(pop_rdi) + p64(stack_page)     # page-aligned address
rop += p64(pop_rsi) + p64(0x1000)         # size
rop += p64(pop_rdx) + p64(7)              # PROT_READ|PROT_WRITE|PROT_EXEC
rop += p64(mprotect_addr)
rop += p64(shellcode_addr)                 # jump to shellcode on now-executable stack

---

5. RELRO BYPASS

Full RELRO Alternative Targets

See arbitrary-write-to-rce for comprehensive target list.

---

6. CANARY BYPASS

Canary Format

x86:    0x00XXXXXX (4 bytes, leading null byte)
x86-64: 0x00XXXXXXXXXXXXXX (8 bytes, leading null byte)

The leading \x00 prevents string operations from accidentally reading the canary.

---

7. FORTIFY_SOURCE BYPASS

_FORTIFY_SOURCE=2 adds buffer size checking and restricts format string operations.

Format String with FORTIFY_SOURCE

# %1$n is blocked by __printf_chk
# But sequential (non-positional) %n may still work:
# Print exact byte count, then %hn — must be very precise
# Or: find unfortified printf in binary/libc via ROP

---

8. CET (Control-flow Enforcement Technology)

Intel CET adds two mechanisms:

Shadow Stack

• Hardware-maintained copy of return addresses
• On ret, CPU checks shadow stack matches actual stack
• Mismatch → #CP fault (control protection exception)

Indirect Branch Tracking (IBT)

• Indirect jmp/call must land on ENDBR64 instruction
• Non-ENDBR landing → #CP fault

Bypass:

• Data-only attacks (don't change control flow)
• Find valid ENDBR gadgets that chain into useful operations
• JOP with ENDBR-prefixed gadgets
• Target structures outside CFI scope (modprobe_path, function pointer arrays)

---

9. MTE (Memory Tagging Extension, ARM)

ARM MTE assigns 4-bit tags to memory pointers and allocations. Tag mismatch = fault.

Bypass Approaches

---

10. DECISION TREE

Binary analysis: checksec output
├── NX disabled?
│   └── Shellcode on stack/heap (simplest path)
│
├── NX enabled (standard modern binary)?
│   ├── Need code execution → ROP/ret2libc
│   │
│   ├── Canary enabled?
│   │   ├── fork server? → byte-by-byte brute-force
│   │   ├── Format string? → leak canary via %p
│   │   ├── Heap vuln? → canary doesn't protect heap
│   │   └── Partial RELRO? → overwrite __stack_chk_fail@GOT
│   │
│   ├── PIE enabled?
│   │   ├── Format string? → leak .text address → PIE base
│   │   ├── Partial overwrite → last 12 bits fixed (1/16 brute-force)
│   │   └── OOB read? → leak code pointer
│   │
│   ├── ASLR enabled?
│   │   ├── Info leak available → leak libc base
│   │   ├── No leak → ret2dlresolve or SROP
│   │   ├── 32-bit? → brute-force feasible (~4096 attempts)
│   │   └── Return-to-PLT (no libc base needed for PLT calls)
│   │
│   ├── RELRO level?
│   │   ├── None/Partial → GOT overwrite
│   │   └── Full → alternative targets:
│   │       ├── glibc < 2.34 → __malloc_hook / __free_hook
│   │       ├── glibc ≥ 2.34 → _IO_FILE / exit_funcs / TLS_dtor_list
│   │       ├── .fini_array (if writable)
│   │       └── Stack return address
│   │
│   └── FORTIFY_SOURCE?
│       ├── Blocks positional %n → use sequential %n or heap exploit
│       └── Blocks buffer overflows in fortified functions → use unfortified paths
│
├── CET (shadow stack)?
│   ├── ROP blocked → data-only attack or JOP
│   └── ENDBR-gadget chaining
│
└── MTE (ARM)?
    ├── 1/16 brute-force
    └── Stay in-bounds for relative corruption

Protection Bypass Matrix — Comprehensive Cross-Reference

AI LOAD INSTRUCTION: Load this for a systematic lookup of which bypass technique works against which protection, and what primitive is required. Assumes SKILL.md is loaded for individual protection details.

---

1. PROTECTION × BYPASS × PRIMITIVE MATRIX

ASLR Bypass

PIE Bypass

NX Bypass

Canary Bypass

RELRO Bypass

Full RELRO Alternative Target Matrix

---

2. COMBINED PROTECTION SCENARIOS

Scenario: NX + ASLR + Canary + Partial RELRO (Typical CTF)

1. Leak canary via format string or info disclosure
2. Leak libc address via format string or PLT leak (puts@GOT)
3. Craft ROP chain: pop_rdi → "/bin/sh" → system (ret2libc)
4. Overflow: [padding][canary][saved_rbp][ROP chain]

Scenario: NX + ASLR + Canary + Full RELRO + PIE

1. Format string (multi-shot): leak canary + PIE base + libc base
2. Cannot overwrite GOT (Full RELRO) → target __malloc_hook or _IO_FILE
3. Second format string or overflow: write target address
4. Trigger: call malloc (for __malloc_hook) or exit (for _IO_FILE)

Scenario: NX + ASLR + No Canary + No PIE + Partial RELRO (Beginner CTF)

1. No canary → direct overflow to return address
2. No PIE → binary addresses known → PLT/GOT addresses fixed
3. Leak libc: overflow → puts@plt(puts@GOT) → leak → main
4. Second overflow: system("/bin/sh") or one_gadget

Scenario: Static Binary + NX + Canary + ASLR

1. No libc (static) → cannot ret2libc
2. Need canary bypass → leak via available primitive
3. SROP: sigreturn to set all registers → execve("/bin/sh", NULL, NULL)
4. Or: ret2dlresolve not applicable (static) → rely on ROP gadgets from large binary

---

3. COMPILATION FLAGS REFERENCE

QEMU/GDB Testing Flags

# Disable all protections for testing
gcc -fno-stack-protector -z execstack -no-pie -Wl,-z,norelro -o vuln vuln.c
# Disable ASLR for debugging
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
# Or per-process:
setarch $(uname -m) -R ./vuln

---

4. PROTECTION INTERACTION EFFECTS

---

5. QUICK LOOKUP: "I HAVE X, I NEED Y"