Binary Protection Bypass

This is a systematic playbook for identifying and bypassing memory protection mechanisms in compiled binaries. It covers the full stack: ASLR, PIE, NX/DEP, stack canaries, RELRO, and FORTIFY_SOURCE, with each protection mapped to specific bypass techniques and the primitives you need (format string leaks, partial overwrites, ROP chains). The matrix approach is useful because real exploits almost never face a single protection in isolation. You're dealing with combinations, and knowing that Full RELRO blocks GOT overwrites means pivoting to __malloc_hook or vtable hijacking. It's densest on the canonical CTF-style techniques but includes modern stuff like CET and ARM MTE. Best suited for exploit development where you need to quickly map what checksec reports to an actual attack path.

skills.sh installs: 3.9K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill binary-protection-bypass --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Binary Protection Bypass — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert binary protection identification and bypass techniques. Covers ASLR, PIE, NX, RELRO, canary, FORTIFY_SOURCE, stack clash, CET shadow stack, and ARM MTE. Each protection is paired with its bypass methods and required primitives. Distilled from ctf-wiki mitigation sections and real-world exploitation. Base models often confuse which protections block which attacks and miss the combinatorial effect of multiple protections.

0. RELATED ROUTING

stack-overflow-and-rop — ROP chains to bypass NX, ret2libc for ASLR bypass
format-string-exploitation — primary method for leaking canary, PIE, libc addresses
heap-exploitation — heap attacks for RELRO bypass (when GOT is read-only)
arbitrary-write-to-rce — what to overwrite when GOT is protected by RELRO