memory-corruption

name	Memory Corruption
description	Memory corruption & mitigation bypass — UAF, OOB, PAC, ASLR, CFI, CET, RCE, binary exploit
tags	["memory","corruption","uaf","oob","out-of-bounds","heap","overflow","use-after-free","rce","remote-code-execution","binary-exploit","double-free","stack overflow","pac","pointer-authentication","aslr","cfi","control-flow-integrity","cet","shadow-stack","mte","memory-tagging","relro","pie","canary","bypass","exploitation"]

Task: Memory Corruption Analysis & Advanced Mitigation Bypass. Detect and exploit memory corruption vulnerabilities, bypass modern protections (PAC, ASLR, CFI, CET, MTE), achieve local/remote code execution.

Approach

Modern exploitation requires understanding both memory corruption bugs and mitigation bypass techniques. Focus on: UAF, OOB, overflow vulnerabilities, and systematically bypassing PAC, ASLR, CFI, CET, and other hardening mechanisms.

Quick Reference: Modern Mitigations & Bypass Strategies

ARM64 Protections

PAC (Pointer Authentication Codes)
- Purpose: Signs pointers to prevent modification
- Bypass: Signing oracle, UAF, forgery, brute force (1/65536)
- Target: iOS 12+, Android 11+, modern ARM64

MTE (Memory Tagging Extension)
- Purpose: Tags memory allocations to detect corruption
- Bypass: Tag brute force (1/16), tag leak, non-MTE regions
- Target: Android 14+, ARM64v8.5+

x86/x64 Protections

ASLR (Address Space Layout Randomization)
- Purpose: Randomize memory addresses
- Bypass: Info leak, partial overwrite, brute force
- Impact: Reduces exploit reliability

CET (Control-flow Enforcement Technology)
- Purpose: Shadow stack for return addresses
- Bypass: Stack pivot, forward-edge only, SCS corruption
- Target: Intel 11th Gen+, AMD Zen 3+

CFI (Control Flow Integrity)
- Purpose: Validate indirect call/jump targets
- Bypass: Compatible gadgets, data-only attacks
- Target: Windows CFG, LLVM CFI

Classic Protections

NX/DEP (No-Execute)
- Purpose: Prevent shellcode execution
- Bypass: ROP chains, ret2plt, return-to-libc

Stack Canaries
- Purpose: Detect stack buffer overflows
- Bypass: Info leak, brute force (fork), skip check

PIE (Position Independent Executable)
- Purpose: Randomize code base address
- Bypass: Info leak, partial overwrite

RELRO (Relocation Read-Only)
- Purpose: Make GOT read-only (Full RELRO)
- Bypass: Partial RELRO, function pointers, ret2plt

Phase 1: Allocator Analysis

Identify Memory Allocator

Linux: glibc malloc (ptmalloc2), jemalloc, tcmalloc
Windows: HeapAlloc, RtlAllocateHeap, NT Heap
Custom: Application-specific allocators

Check:
- Import symbols (malloc, free, HeapAlloc)
- String patterns ("jemalloc", "tcmalloc")
- Heap metadata structures

Heap Layout Analysis

Understand heap organization:
- Chunk size and boundaries
- Metadata locations (size, flags, pointers)
- Free lists (fastbin, smallbin, largebin)
- Tcache (glibc 2.26+)

Tools:
- decompile malloc/free wrappers
- Analyze heap metadata structures
- Map heap layout from memory dumps

Phase 2: Vulnerability Discovery

Out-of-Bounds (OOB) Read/Write

Pattern Detection:
1. Array access without bounds checking
2. Buffer index under user control
3. Off-by-one errors in loops
4. Integer overflow leading to OOB

Code Patterns:
- array[user_input] = value;  // OOB write
- value = array[user_index];  // OOB read
- memcpy(dst, src, user_size);  // user_size not validated
- buffer[i++] = data;  // No bounds check on i

Search:
- xrefs_to on array accesses, brackets []
- Look for loops with user-controlled indices
- Check arithmetic on indices (multiplication, addition)
- Find missing bounds checks before array access

Impact:
- OOB Read: Information leak, ASLR bypass
- OOB Write: Memory corruption, arbitrary write
- Combined: Read leak → Write exploit → RCE

Use-After-Free (UAF)

Pattern Detection:
1. free(ptr); followed by ptr->method()
2. Double free: free(ptr); free(ptr);
3. Dangling pointers in structures
4. Reference count bugs

Code Patterns:
- free(object); object->vtable()
- pthread_mutex_unlock(&mutex); mutex->data
- Release without clearing pointers

Search:
- xrefs_to on free, HeapFree
- Look for continued use after free
- Check reference counting logic

Double-Free

Detection:
1. Same pointer freed twice
2. Free list corruption
3. Allocator crash: "double free or corruption"

Code Pattern:
ptr = malloc(100);
free(ptr);
... (no realloc)
free(ptr);  // ← Double free

Exploitation:
- Fastbin attack (glibc)
- Unsafe unlink
- Tcache poisoning

Heap Overflow

Detection:
1. Copy beyond allocated size
2. Off-by-one errors
3. Integer overflow in size

Code Pattern:
buf = malloc(user_size);
memcpy(buf, input, user_size + 8);  // Overflow
Or:
buf = malloc(size * 4);  // Integer overflow
memcpy(buf, input, user_input);

Impact:
- Corrupt adjacent chunks
- Overwrite chunk metadata
- Control malloc/free behavior

Stack Overflow

Detection:
1. Fixed-size buffers + unbounded copy
2. Recursive calls without limit
3. Large stack allocations

Code Pattern:
char buffer[256];
strcpy(buffer, user_input);  // No bounds check
Or:
char buffer[512];
gets(buffer);  // Always dangerous

Impact:
- Overwrite return address
- Corrupt stack canaries
- Hijack control flow

Phase 3: Exploitation Techniques

Out-of-Bounds (OOB) Exploitation

OOB Read for Info Leak:
1. Read adjacent memory objects via OOB array access
2. Leak addresses: heap pointers, stack addresses, libc base
3. Bypass ASLR: Calculate base addresses from leaked pointers
4. Read sensitive data: passwords, tokens, encryption keys
5. Combine with OOB write for exploitation

OOB Write for Corruption:
Method 1: Adjacent Object Corruption
- Allocate object A before target object B
- OOB write from A corrupts B's metadata/pointers
- Overwrite function pointers, vtables, size fields
- Trigger corruption when B is used

Method 2: Array Index Abuse
- Array[index] where index is negative or too large
- Write to arbitrary memory locations
- Target: GOT entries, function pointers, vtables
- Calculate index: (target_address - array_address) / element_size

Method 3: Buffer Overflow via OOB
- Linear buffer with controlled size
- Write past buffer bounds
- Corrupt adjacent memory (stack frames, heap chunks)
- Control execution flow

OOB Exploitation Chain:
1. OOB Read → Leak libc/heap addresses (bypass ASLR)
2. OOB Write → Overwrite function pointer or GOT entry
3. Trigger corrupted function call
4. Redirect execution to system()/shellcode
5. Achieve RCE

OOB + Heap Feng Shui:
1. Shape heap layout with allocations
2. Place target object after vulnerable buffer
3. OOB write corrupts target object
4. Control object's vtable or function pointers
5. Trigger virtual function call

Use-After-Free Exploitation

Method 1: Vtable Hijack
1. Allocate object A (with vtable)
2. Free object A
3. Allocate object B with controlled data
4. Object B occupies A's memory
5. Call virtual function on A
6. Executes B's vtable pointer → controlled call

Method 2: Function Pointer Overwrite
1. Free object with function pointer
2. Realloc with controlled data
3. Overwrite function pointer
4. Trigger function call
5. Control execution flow

Method 3: Partial Overwrite
1. Free object
2. Realloc partially overlapping object
3. Overwrite critical fields only
4. Preserve other functionality

Double-Free Exploitation

Fastbin Attack (glibc):
1. malloc(A) → free(A) → free(A) (double free)
2. A in fastbin twice
3. malloc(X) → contains A's address
4. Overwrite A's fd pointer
5. malloc(Y) → returns controlled address
6. malloc(Z) → returns fake chunk (write-what-where)

Unsafe Unlink:
1. Overflow chunk to corrupt forward/backward pointers
2. Forward pointer: &target - offset
3. Backward pointer: &target - offset*2
4. Trigger unlink → arbitrary write

Heap Overflow Exploitation

Chunk Metadata Corruption:
1. Overflow size field
2. Set size to large value
3. Next malloc returns chunk overlapping other data
4. Overwrite function pointers, vtables

Allocator Primitive:
1. Corrupt chunk → control malloc/free
2. Allocate arbitrary addresses
3. Overwrite GOT, .dtors, hooks
4. Code execution

Tcache Poisoning (glibc 2.26+):
1. Overflow tcache chunk's next pointer
2. Next malloc returns arbitrary address
3. Write-what-where primitive
4. Overwrite __free_hook or __malloc_hook

Stack Overflow Exploitation

Return Address Overwrite:
1. Calculate offset to saved EIP
2. Overflow with: padding + address
3. Control execution after function return
4. Bypass canaries if present

Canary Bypass:
1. Info leak: Read canary value
2. Brute force: Forking server (1/256)
3. Overwrite: Skip canary check
4. Jump over: Control flow after canary

SEH Overwrite (Windows):
1. Overflow to SEH chain
2. Overwrite SEH handler address
3. Trigger exception → handler
4. Bypass SafeSEH with pop/pop/ret

Phase 4: Advanced Techniques

Heap Spraying

Goal: Predictable allocation at target address

Method:
1. Allocate many objects of same size
2. Fill heap with controlled data
3. Free/create holes at target locations
4. Trigger vulnerability
5. Land in sprayed heap

Targets:
- JavaScript engines (ArrayBuffer)
- Browser heaps (WebAssembly)
- PDF readers (object allocation)

Heap Feng Shui

Goal: Arrange heap for exploitation

Techniques:
1. Coalesce free chunks
2. Create holes at specific offsets
3. Control allocation order
4. Align objects precisely

Example:
- Allocate 100 objects
- Free every 10th object
- Trigger overflow
- Land in predictable location

Race Condition Exploitation

TOCTOU (Time-of-Check-Time-of-Use):
1. Thread A: Check permissions
2. Thread B: Swap file before use
3. Thread A: Use file with wrong permissions

Heap Race:
1. Thread A: free(object)
2. Thread B: realloc object
3. Thread A: use object (UAF)
4. Win race → exploitation

Exploit:
- Multi-threaded program
- Parallel operations
- Race to corrupt state

Phase 5: Allocator Internals

glibc Malloc (ptmalloc2)

Chunk Structure:
+--------+--------+--------+--------+
| Prev   | Size   |  ...   |  ...   |
| size   | +flags | data   |  ...   |
+--------+--------+--------+--------+

Metadata:
- Size field (includes flags)
- PREV_INUSE (previous chunk in use)
- IS_MMAPPED (mmap'd chunk)
- NON_MAIN_ARENA (non-main arena)

Bins:
- Fastbin (size < 64, single-linked)
- Smallbin (size < 512, double-linked)
- Largebin (size >= 512, sorted)
- Tcache (per-thread cache, glibc 2.26+)

Windows Heap

Heap Header:
+-----------+-----------+-----------+
| Signature | Flags     | Size      |
| Encoding  | Segment   | Unusable |
+-----------+-----------+-----------+

Allocators:
- LFH (Low-Fragmentation Heap)
- Front-end allocator
- Back-end allocator

Exploitation:
- Overwrite heap header
- Corrupt lookaside list
- Front-end heap metadata corruption

jemalloc

Structure:
- Arenas (allocation contexts)
- Bins (size classes)
- Runs (contiguous pages)
- Chunks (allocations)

Metadata:
- Red-black trees for large allocations
- Per-thread caches (tcache)
- Size-class bins

Exploitation:
- Tcache poisoning
- Bin corruption
- Arena metadata overwrite

Phase 6: Detection & Analysis

Dynamic Analysis

Tools:
- Valgrind (memcheck, addrcheck)
- AddressSanitizer (ASan)
- MemorySanitizer (MSan)
- Electric Fence
- GDB heap commands

Detection:
- Use-after-free
- Double-free
- Heap overflow
- Invalid access

Static Analysis

Code Review:
- free() usage patterns
- malloc() + memcpy() combinations
- Array bounds checking
- Pointer lifetime tracking

Tools:
- Coverity
- CodeQL
- Semgrep
- Custom grep patterns

Runtime Instrumentation

Techniques:
- Hook malloc/free
- Track allocations
- Detect corruption
- Log memory operations

Tools:
- LD_PRELOAD hooks
- Frida scripts
- Pin tools
- DynamoRIO

Phase 7: Exploit Development

Local Exploit

1. Reproduce crash
2. Analyze corruption
3. Build primitive
4. Stabilize exploit
5. Bypass mitigations
6. Achieve code execution

Remote Code Execution (RCE)

Network-Based Exploitation:
1. Identify network entry point (socket, HTTP parser, network daemon)
2. Control remote heap layout via network packets
3. Trigger vulnerability remotely (OOB write, UAF, overflow)
4. Bypass remote mitigations (ASLR, NX, canaries)
5. Achieve remote shell or command execution
6. Stabilize remote connection

Remote Heap Grooming:
- Send multiple packets to shape remote heap
- Create holes at specific offsets
- Spray heap with controlled objects via network
- Time exploitation with packet sequences

RCE Vector Examples:
- Network parsers (HTTP, FTP, custom protocols)
- File parsers (PDF, JPG, DOC via network share)
- RPC/IPC handlers
- Database query processors
- API endpoints

Remote Exploit Chains:
OOB Read → Leak remote addresses → OOB Write → ROP → Remote Shell
UAF → Fake vtable → Remote function call → Reverse shell
Overflow → Overwrite return address → Shellcode execution → Bind shell

Binary Exploitation Techniques

Static Binary Exploitation (No PIE/RELRO):
1. All addresses fixed and predictable
2. Direct jump to system()/execve()
3. Shellcode in .bss or data sections
4. Simple ROP chains with fixed addresses

Dynamic Binary Exploitation (PIE/ASLR):
1. Info leak: printf("%p", stack), read(), uninitialized variables
2. Partial overwrite: Only overwrite 12 bits of address
3. GOT overwrite: Redirect library functions
4. Vtable hijacking: C++ virtual function tables

Advanced Binary Techniques:
- Return-oriented programming (ROP)
- Jump-oriented programming (JOP)
- Call-oriented programming (COP)
- Sigreturn-oriented programming (SROP)
- Fake Stack Frame (Stack pivoting)
- File structure exploitation (FILE* abuse)
- Virtual Function Table (VTable) hijacking

Advanced Mitigation Bypass

PAC (Pointer Authentication Codes) Bypass:
Target: ARM64 with pointer signing (iOS, Android, modern ARM)

Method 1: PAC Oracle/Guessing Attack
- Brute force PAC signatures via fault analysis
- Use memory corruption to create oracle
- 16-bit PAC: ~65536 attempts (feasible in some contexts)
- Combine with info leak to reduce search space

Method 2: Pointer Signing Bypass via UAF
- Use-After-Free on signed pointer
- Reallocation with controlled data
- Overwrite pointer before signing occurs
- Skip PAC validation entirely

Method 3: PAC Forgery via Signing Oracle
- Find signing primitive (signing gadget)
- Create valid PAC for arbitrary pointers
- Sign malicious pointers with stolen key
- Inject forged signed pointers

Method 4: PAC Removal/Stripping
- Find unsigning primitive
- Remove PAC from signed pointers
- Replace with unsigned pointers
- Target: AArch64 PACIASP/AUTIASP instructions

Method 5: Context Corruption
- Corrupt PAC context registers
- Modify signing key state
- Invalidate PAC checks
- Target: Thread-local PAC keys

ASLR (Address Space Layout Randomization) Bypass:
Target: Randomized memory layouts (stack, heap, libraries, PIE)

Method 1: Info Leak Primitive
- Format string vulnerabilities: printf("%p", ptr)
- Uninitialized variable reads
- Array/struct overflow leaks
- Debug output/log files
- Side channels (timing, cache)

Method 2: Partial Address Overwrite
- Exploit page-aligned ASLR (only 12 bits random)
- Overwrite last 1-2 bytes instead of full address
- Keep upper bytes intact
- Success rate: High (1/256 to 1/4096)
- Example: 0x7ffff7a12000 → overwrite last 2 bytes → 0x7ffff7a12xyz

Method 3: Heap Feng Shui + Spraying
- Spray heap to predict allocation addresses
- Control heap layout to reduce entropy
- Force allocations at known offsets
- Combine with partial overwrite

Method 4: GOT/PLT Overwrite (No RELRO)
- Target: Global Offset Table entries
- Overwrite library function addresses
- Redirect to controlled code
- Bypass: Full RELRO prevents this

Method 5: VTable Hijacking (C++)
- Target: C++ virtual function tables
- Overwrite vtable pointer in object
- Redirect to fake vtable in controlled memory
- Bypass: Vtable pointer is signed (PAC)

Method 6: ELF/AOUT Structure Manipulation
- Target: Binary metadata structures
- Modify executable sections
- Change entry points
- Bypass: Signed binaries prevent this

CFI (Control Flow Integrity) Bypass:
Target: Indirect call/jump protection (Microsoft CFI, LLVM CFI)

Method 1: CFI-compatible Gadgets
- Find gadgets that satisfy CFI constraints
- Use valid call targets in CFI policy
- Jump to valid function pointers
- Bypass: Use legitimate functions as gadgets

Method 2: Data-Only Attacks
- Avoid violating control flow
- Modify data instead of code pointers
- Overwrite configuration, flags, credentials
- Impact: Data corruption, privilege escalation

Method 3: Forward-Edge CFI Bypass
- Target: Function pointers before CFI check
- Race condition: Overwrite between validation and use
- Type confusion: Cast to compatible type
- Bypass: Weak typing in C/C++

Method 4: Backward-Edge CFI Bypass
- Target: Return addresses (shadow stack, RSS)
- Stack pivot to controlled stack
- Overwrite shadow stack via memory corruption
- Bypass: Stack canaries + shadow stack

Stack Clash / Stack Overflow Protection Bypass:
Target: Large stack allocations, stack gap protection

Method 1: Stack Clash Jump
- Allocate large stack frame
- Jump over stack guard page
- Corrupt adjacent memory mapping (heap, mmap)
- Write to stack-adjacent memory

Method 2: Stack Pivot (RSP Hijacking)
- xchg esp, eax; ret
- mov esp, eax; ret  
- leave; ret (mov rsp, rbp; pop rbp; ret)
- Migrate to controlled heap buffer

Method 3: Frame Pointer Overwrite
- Corrupt saved EBP/RBP
- Chain fake stack frames
- Each leave; ret loads next fake frame
- Bypass: Stack canaries don't protect EBP

CET/Shadow Stack (Control-flow Enforcement Technology) Bypass:
Target: x86 shadow stack, return address protection

Method 1: Shadow Stack Corruption
- Find write primitive to shadow stack memory
- Overwrite return addresses on shadow stack
- Bypass: Shadow stack is read-only normally

Method 2: Stack Pivot Before Return
- Hijack control before CET check
- Overwrite RSP to point away from shadow stack
- Shadow stack validation skipped

Method 3: Forward-Edge Only Attacks
- Don't target return addresses
- Use function pointers, vtables, GOT
- Target indirect calls (jmp/call *reg)
- Bypass: CET only protects backward-edge

Method 4: Signal Handler Abuse
- Signal handlers use alternate stack
- Corrupt signal handler frame
- Return via sigreturn() frame
- Bypass: Shadow stack not enforced on signals

MTE (Memory Tagging Extension) Bypass:
Target: ARM64 MTE (memory tags for corruption detection)

Method 1: Tag Brute Force
- MTE uses 4-bit tags (16 possible values)
- Try all 16 tag values
- 1/16 success rate per attempt
- Combine with heap spraying

Method 2: Tag Leakage
- Info leak to discover valid tags
- Read tagged pointers from memory
- Extract tag bits (top byte)
- Use leaked tags for corruption

Method 3: Untagged Memory Regions
- Target allocations without MTE enabled
- Legacy code, specific allocators
- Memory-mapped regions
- Bypass: Use non-MTE allocations

Method 4: Tag Collision via UAF
- Free tagged allocation
- Reallocate with different tag
- Use stale pointer with old tag
- Cause tag mismatch on access

RELRO (Relocation Read-Only) Bypass:
Target: Partial/Full RELRO (GOT protection)

Method 1: Partial RELRO GOT Overwrite
- Only .dynamic section is read-only
- GOT entries remain writable
- Overwrite GOT entries (printf, system, etc.)
- Redirect to controlled code

Method 2: Full RELRO via Function Pointer
- GOT is read-only, find alternative targets
- vtable pointers (C++)
- Function pointers in data sections
- Callback structures

Method 3: ret2plt (Return to PLT)
- Call plt functions directly
- Use existing PLT entries as gadgets
- Chain: ret2plt → system@plt
- Bypass: Need to control arguments

Method 4: _dl_runtime_resolve Overwrite
- Target: Lazy resolution resolver
- Overwrite resolver function pointer
- Control resolution of future calls
- Bypass: Full RELRO disables lazy resolution

PIE (Position Independent Executable) Bypass:
Target: PIE binaries (code base address randomized)

Method 1: Info Leak via Format String
- printf/format functions leak stack addresses
- Contains return addresses to PIE code
- Calculate PIE base: leaked_addr - offset
- Bypass: Full ASLR on PIE

Method 2: GOT Entry Leak
- Read GOT entries (function pointers)
- Contains addresses to libc functions
- Calculate libc base
- Calculate PIE base via offset

Method 3: Partial Overwrite of PIE Addresses
- PIE only randomizes page alignment (12 bits)
- Overwrite last 1-2 bytes of PIE address
- Keep page-aligned upper bytes
- Redirect to gadgets in same page

Method 4: Non-PIE Targets
- Check: get_binary_info → PIE disabled?
- If no PIE: All code addresses fixed
- Easy ROP chain construction
- Direct jump to known addresses

Stack Canaries Bypass:
Target: Stack canaries (random values before saved EBP)

Method 1: Canary Info Leak
- Format string: read canary from stack
- Uninitialized variable: contains leaked canary
- Debug output: verbose logging
- Overwrite: Include leaked canary in payload

Method 2: Fork/Brute Force (1/256)
- Forking server creates new process each request
- Canary only randomizes lower byte (8 bits)
- Brute force: 256 attempts average
- Detect crash: Segfault = wrong canary

Method 3: Canary Skip (Jump Over)
- Overwrite EIP to jump over canary check
- Target: Instructions after stack protection check
- Use stack pivot or frame faking
- Bypass: Skip canary validation entirely

Method 4: Canary Collision via UAF
- Use-After-Free on canary-protected buffer
- Reallocate with controlled data
- Overwrite canary with known value
- Use stale pointer to trigger check

Shadow Call Stack (SCS) Bypass:
Target: LLVM SCS, return address protection

Method 1: SCS Memory Corruption
- Find write primitive to SCS region
- Overwrite return addresses on shadow stack
- Bypass: SCS is in protected memory

Method 2: Stack Pivot to Non-SCS
- Migrate stack away from SCS-protected region
- Shadow stack validation disabled
- Control RSP before return

Method 3: SCS Pointer Overwrite
- Target: SCS pointer stored in thread-local storage
- Overwrite pointer to bypass validation
- Redirect to fake shadow stack

Comprehensive Mitigation Bypass Strategy:
Order of Operations:
1. Info Leak → Bypass ASLR/PIE (get addresses)
2. Heap Feng Shui → Prepare allocation layout
3. OOB/UAF/Overflow → Build write primitive
4. Canary/Stack Check → Bypass or skip validation
5. PAC/CET → Forge signed pointers or avoid checks
6. CFI → Use compatible gadgets or data-only attacks
7. NX/DEP → ROP chains or ret2plt
8. Final: Chain all bypasses for RCE

Example Chain:
OOB Read (leak libc) → Partial Overwrite (bypass ASLR) → 
UAF (write primitive) → PAC Forgery (signed pointer) → 
ROP Chain (bypass NX) → System/Execve (RCE)

Final Report

[VULNERABILITY] Use-After-Free at 0x401234
Type: Use-After-Free
Severity: CRITICAL (code execution)
Allocator: glibc ptmalloc2

[Bug Details]
Location: vuln_func + 0x56
Object: 0x100 bytes heap allocation
Free: Line 42 (free(obj))
Use: Line 58 (obj->method())

[Exploitation]
1. Allocate object A (vtable @ 0x405000)
2. Trigger free(A)
3. Heap spray with fake vtable @ 0x41410000
4. Realloc at A's address (sprayed data)
5. Call obj->virtual_func()
6. Jumps to fake_vtable[0] → shellcode

[POC]
obj = allocate_object();
free(obj);
// Spray heap with fake vtable
fake_vtable[0] = shellcode_address;
trigger_realloc(); // Overlaps obj
obj->virtual_func(); // Hijacked!

Mitigations: ASLR (partial overwrite), NX (ROP), PIE (info leak)
Bypass: Heap spray + partial overwrite + ROP

Phase 8: Modern Exploitation Scenarios

Scenario 1: ARM64 iOS Exploitation with PAC

Target: iOS app with PAC enabled (iPhone 12+)

Mitigations:
- PAC (Pointer Authentication)
- ASLR (Address Space Layout Randomization)
- PIE (Position Independent Executable)
- Hardened Runtime

Exploitation Chain:
1. OOB Read → Leak heap addresses (bypass ASLR)
2. UAF → Reallocate with controlled vtable
3. PAC Signing Oracle → Brute force signature (1/65536)
4. Vtable Hijack → Use PAC-signed fake vtable
5. Code Execution → Call virtual function with signed pointer

Tools:
- Frida for runtime manipulation
- debugging with lldb
- heap grooming via ObjC objects

Scenario 2: Modern Linux with Full Mitigations

Target: Linux binary with Full RELRO, PIE, Canaries, NX, ASLR

Mitigations:
- Full RELRO (GOT read-only)
- PIE (code base randomized)
- Stack Canaries
- NX/DEP (no shellcode execution)
- ASLR (full randomization)

Exploitation Chain:
1. Format String → Leak PIE base and libc base
2. UAF → Build arbitrary write primitive
3. Overwrite __malloc_hook → Not available (Full RELRO)
4. Alternative: Overwrite function pointer in data section
5. ROP Chain → Use existing code gadgets (bypass NX)
6. Partial Overwrite → Bypass ASLR on stack addresses

Gadgets Required:
- pop rdi; ret
- pop rsi; ret
- pop rdx; ret
- syscall; ret
- ret (alignment)

Scenario 3: Windows with CFG, CET, ASLR

Target: Windows 11 application with Control Flow Guard

Mitigations:
- CFG (Control Flow Guard)
- CET (Shadow Stack)
- ASLR
- DEP (Data Execution Prevention)
- CFG Export Suppression

Exploitation Chain:
1. Info Leak → Read module base addresses
2. Stack Pivot → Migrate away from CET-protected stack
3. CFG-Compatible Gadgets → Use valid call targets
4. ROP Chain → Only call CFG-valid functions
5. Data-Only Attack → Modify configuration data
6. Token Manipulation → Privilege escalation

CFG Bypass Techniques:
- Use legitimate CFG-valid functions as gadgets
- Target function pointers before CFG validation
- Race condition: Overwrite between validation and use
- Data-only: Don't violate control flow

Scenario 4: Android with MTE and PAC

Target: Android 14+ with Memory Tagging Extension

Mitigations:
- MTE (Memory Tagging Extension)
- PAC (Pointer Authentication)
- ASLR
- PIE
- SELinux (restricts syscalls)

Exploitation Chain:
1. Tag Brute Force → Try all 16 MTE tag values
2. OOB Read → Leak addresses and tags
3. Tag Collision → Use UAF to bypass tag checks
4. PAC Forgery → Sign malicious pointers
5. ROP Chain → Bypass NX with MTE-aware gadgets
6. Shellcode → Execute in non-MTE region

MTE Bypass:
- Target allocations without MTE enabled
- Legacy code paths without tagging
- Memory-mapped regions (mmap)
- Heap spraying with correct tags

Scenario 5: Remote Exploitation with Network ASLR

Target: Network daemon with all mitigations

Mitigations:
- ASLR (per-process randomization)
- PIE
- Stack Canaries
- NX
- Remote network attack surface

Exploitation Chain:
1. Network Parser Bug → Trigger OOB write
2. Remote Heap Grooming → Shape heap via packets
3. OOB Read → Leak remote addresses (bypass remote ASLR)
4. Partial Overwrite → Only overwrite 12 bits
5. ROP Chain → Build chain in remote process
6. Reverse Shell → Connect back to attacker

Remote Challenges:
- No debugger access
- Limited heap grooming control
- Network reliability issues
- One-shot exploitation (no crashes)
- ASLR per-process (need leak each time)

Stabilization:
- Use reliable info leak primitives
- Build heap grooming via packet sequences
- Test exploitation locally first
- Use partial overwrite for high success rate
- Implement exploit retry logic

Scenario 6: Kernel Exploitation with SMEP, SMAP, KPTI

Target: Linux kernel with modern mitigations

Mitigations:
- SMEP (Supervisor Mode Execution Prevention)
- SMAP (Supervisor Mode Access Prevention)
- KPTI (Kernel Page Table Isolation)
- KASLR (Kernel ASLR)
- Stack Canaries (kernel stack)

Exploitation Chain:
1. Kernel Driver Bug → Stack overflow in IOCTL
2. KASLR Bypass → Leak kernel base via info leak
3. Build Primitive → Arbitrary kernel read/write
4. SMEP Bypass → ROP chain in kernel, no shellcode
5. SMAP Bypass → Use kernel APIs, avoid user access
6. KPTI Bypass → Data-only attack or exploit before KPTI
7. Token Overwrite → Copy SYSTEM token to current process
8. Privilege Escalation → Spawn root shell

Kernel ROP Gadgets:
- Native kernel functions (no user-mode)
- ROP: pop rdi; ret; pop rax; ret; syscall;
- Commit_creds(prepare_kernel_cred(0))
- Swapgs_restore_regs_and_return_to_usermode

Phase 9: Exploit Development Tools

Dynamic Analysis Tools

Memory Debugging:
- GDB with heap commands (heap, bins)
- pwndbg/gef (enhanced GDB)
- Valgrind (memcheck, addrcheck)
- AddressSanitizer (ASan)
- MemorySanitizer (MSan)
- Electric Fence

Binary Analysis:
- IDA Pro / Ghidra (decompilation)
- Binary Ninja (modern decompiler)
- Radare2 / Cutter (open-source)
- Frida (dynamic instrumentation)
- DynamoRIO (dynamic binary instrumentation)

Exploit Development:
- pwntools (Python exploit framework)
- ROPgadget / ropper (gadget finder)
- checksec.sh (mitigation checker)
- one_gadget (libc one-byte ROP gadgets)
- patchelf (modify ELF binaries)

Automatic Exploit Generation

Symbolic Execution:
- angr (binary analysis framework)
- Triton (dynamic symbolic execution)
- KLEE (symbolic execution engine)
- S2E (platform for symbolic execution)

Fuzzing:
- AFL++ (coverage-guided fuzzer)
- libFuzzer (in-process fuzzing)
- Honggfuzz (security fuzzer)
- Sydr (concolic execution)

Crash Analysis:
- GDB crash scripts
- core dump analysis
- minidump analysis
- crash walkback tools

Mitigation Detection

Binary Protections:
- checksec.py (comprehensive check)
- hardening-check (Debian tool)
- readelf -l (check for BIND_NOW)
- eu-readelf (check for RELRO)

Runtime Protections:
- /proc/sys/kernel/randomize_va_space (ASLR status)
- ldd (check shared libraries)
- LD_PRELOAD testing
- runtime instrumentation

Phase 10: Advanced Exploit Techniques

Return-Oriented Programming (ROP) Advanced

Techniques:
- Stack pivoting (xchg esp, eax; ret)
- Frame pointers (leave; ret chains)
- Call-oriented programming (COP)
- Jump-oriented programming (JOP)
- Sigreturn-oriented programming (SROP)

Automated ROP:
- ROPgadget --binary target --ropchain
- ropper --file target --chain
- rp++ --file target --rop
- Python scripts for chain building

Heap Exploitation Advanced

Techniques:
- House of Einherjar (unlink corruption)
- House of Force (overflow size field)
- House of Spirit (fake fastbin chunks)
- House of Roman (partial overwrite + fastbin)
- House of Orange (unsorted bin attack)
- Large bin attack (libc corruption)

Allocator-Specific:
- glibc ptmalloc2 (fastbin, tcache, unsorted bin)
- jemalloc (arenas, bins, runs)
- tcmalloc (thread-local caches)
- Windows LFH (Low-Fragmentation Heap)

Format String Exploitation

Techniques:
- Direct parameter access (%n$x)
- Write primitives (%n)
- Overwrite GOT entries
- Overwrite .dtors destructors
- Overwrite function pointers
- Stack pivot via format string

Advanced:
- Format string blind exploitation
- Counter overflow (%100000d%n)
- Large write primitives
- Combined with buffer overflow

Race Condition Exploitation

Techniques:
- TOCTOU (Time-of-Check-Time-of-Use)
- Double-fetch vulnerabilities
- Threaded heap exploitation
- Signal handler race conditions
- Exploit via multiple threads

Tools:
- Threaded exploit code
- Race condition fuzzing
- Symbolic execution for races
- Atomic operation bypass

Quick Reference: Mitigation Bypass Matrix

┌─────────────────────────────────────────────────────────────────┐
│ Mitigation       │ Bypass Techniques                            │
├─────────────────────────────────────────────────────────────────┤
│ ASLR             │ Info leak, partial overwrite, brute force   │
│ PIE              │ Leak PIE base, partial overwrite            │
│ NX/DEP           │ ROP chains, ret2plt, return-to-libc        │
│ Stack Canaries   │ Info leak, brute force (fork), skip check   │
│ RELRO            │ GOT overwrite (partial), function pointers  │
│ PAC              │ Signing oracle, UAF, forgery, removal       │
│ CET/Shadow Stack │ Stack pivot, forward-edge only, SCS corrupt  │
│ CFI              │ Compatible gadgets, data-only, type confusion│
│ MTE              │ Tag brute force, tag leak, non-MTE regions   │
│ CFG              │ Valid call targets, data-only, race condition│
│ SMEP             │ Kernel ROP, no shellcode                    │
│ SMAP             │ Data-only, kernel APIs                      │
│ KPTI             │ Pre-KPTI leak, data-only, speculative exec  │
│ KASLR            │ Info leak, symbol leaks, kernel dmesg       │
└─────────────────────────────────────────────────────────────────┘