# Bypassing Binary Exploitation Mitigations

Methodology for identifying and defeating common binary hardening mitigations during...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill bypassing-binary-exploitation-mitigations -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill bypassing-binary-exploitation-mitigations -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill bypassing-binary-exploitation-mitigations -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill bypassing-binary-exploitation-mitigations -g -a gemini-cli -y`

## Description

Methodology for identifying and defeating common binary hardening mitigations during authorized exploitation, ASLR, PIE, stack canaries, NX/DEP, and RELRO, by leaking addresses, brute-forcing entropy, abusing forked-process behavior, and selecting the right code-reuse primitive for the protections in place.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Bypassing Binary Exploitation Mitigations

## When to Use

- At the start of any authorized binary exploitation engagement, to profile which protections (ASLR, PIE, canary,
  NX/DEP, RELRO) are active and plan the exploit path accordingly.
- When a working memory-corruption primitive is blocked by a mitigation: a canary aborts the process, NX prevents
  shellcode, PIE/ASLR randomizes gadget addresses, or Full RELRO makes the GOT read-only.
- When deciding what to leak (libc pointer, PIE base, canary) and how (format string, ret2plt, arbitrary read,
  brute force in a forked server).

## Critical: Concepts/Steps Most Often Missed

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/binary-exploitation/bypassing-binary-exploitation-mitigations/SKILL.md