SKILL: Binary Protection Bypass, Expert Attack Playbook

AI LOAD INSTRUCTION: Expert binary protection identification and bypass techniques. Covers ASLR, PIE, NX, RELRO, canary, FORTIFY_SOURCE, stack clash, CET shadow stack, and ARM MTE. Each protection is paired with its bypass methods and required primitives. Distilled from ctf-wiki mitigation sections and real-world exploitation. Base models often confuse which protections block which attacks and miss the combinatorial effect of multiple protections.

0. RELATED ROUTING

• stack-overflow-and-rop, ROP chains to bypass NX, ret2libc for ASLR bypass
• format-string-exploitation, primary method for leaking canary, PIE, libc addresses
• heap-exploitation, heap attacks for RELRO bypass (when GOT is read-only)
• arbitrary-write-to-rce, what to overwrite when GOT is protected by RELRO

Advanced Reference

Load PROTECTION_BYPASS_MATRIX.md for comprehensive protection × bypass × primitive matrix.

---

1. PROTECTION IDENTIFICATION

$ checksec ./binary
[*] '/path/to/binary'
    Arch:     amd64-64-little
    RELRO:    Full RELRO          ← GOT read-only
    Stack:    Canary found        ← stack canary enabled
    NX:       NX enabled          ← stack not executable
    PIE:      PIE enabled         ← position-independent code
    FORTIFY:  Enabled             ← fortified libc functions

Quick Identification Table