bypassing-binary-exploitation-mitigations

name	bypassing-binary-exploitation-mitigations
description	Methodology for identifying and defeating common binary hardening mitigations during authorized exploitation — ASLR, PIE, stack canaries, NX/DEP, and RELRO — by leaking addresses, brute-forcing entropy, abusing forked-process behavior, and selecting the right code-reuse primitive for the protections in place.
domain	cybersecurity
subdomain	binary-exploitation
tags	["binary-exploitation","mitigation-bypass","exploit-development"]
version	1.0
author	xalgorix
license	Apache-2.0

Bypassing Binary Exploitation Mitigations

When to Use

• At the start of any authorized binary exploitation engagement, to profile which protections (ASLR, PIE, canary, NX/DEP, RELRO) are active and plan the exploit path accordingly.
• When a working memory-corruption primitive is blocked by a mitigation: a canary aborts the process, NX prevents shellcode, PIE/ASLR randomizes gadget addresses, or Full RELRO makes the GOT read-only.
• When deciding what to leak (libc pointer, PIE base, canary) and how (format string, ret2plt, arbitrary read, brute force in a forked server).

Critical: Concepts/Steps Most Often Missed

• Each mitigation is bypassed independently — enumerate them all first. checksec output drives everything. A binary can be PIE + canary + Full RELRO + NX, and you must defeat each separately (leak base, leak/forge canary, avoid GOT writes, use ROP).
• Canary low byte is a NUL. On x64 the 8-byte canary's least significant byte is 0x00; on x86 the 4-byte canary's LSB is 0x00. String functions stop on it, so a printed canary leak shows only 7 (or 3) random bytes — account for the NUL when re-inserting it.
• Forked servers share the canary and PIE slide. fork() without execve() means children inherit the parent's canary, so you can brute-force the canary (and PIE/stack addresses) one byte at a time using a crash-vs-success oracle. execve() after fork() defeats this.
• Full RELRO does not protect everything. The main binary's GOT is read-only, but loaded shared libraries (libc) are only Partial RELRO. Modern targets removed __malloc_hook/__free_hook (glibc 2.34+), so pivot to other writable pointers, libc GOT, vtables, or SROP/ROP-into-libc.
• PIE base ends in 000. A leaked code pointer's low 12 bits are the page offset; the base is leak & ~0xfff. If your computed base does not end in 000, your leak or offset is wrong.
• vsyscall/vDSO and fixed kernel maps escape ASLR. 0xffffffffff600000 vsyscall has fixed addresses; on some arm64 Android kernels the linear map base is fixed, defeating KASLR with no leak.

How to CONFIRM

Run checksec --file ./vuln (and readelf -l/-d) and record each protection. Confirm a leak is valid before building on it: a leaked PIE/libc base must be page-aligned (& 0xfff == 0); a leaked canary's LSB must be . Confirm a canary bypass by sending the leaked canary back in the overflow and observing the process (no ). Confirm NX status with (an flag = exec stack).