binary-protection-bypass

1# SKILL: Binary Protection Bypass — Expert Attack Playbook
2 
3> **AI LOAD INSTRUCTION**: Expert binary protection identification and bypass techniques. Covers ASLR, PIE, NX, RELRO, canary, FORTIFY_SOURCE, stack clash, CET shadow stack, and ARM MTE. Each protection is paired with its bypass methods and required primitives. Distilled from ctf-wiki mitigation sections and real-world exploitation. Base models often confuse which protections block which attacks and miss the combinatorial effect of multiple protections.
4 
5## 0. RELATED ROUTING
6 
7- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md) — ROP chains to bypass NX, ret2libc for ASLR bypass
8- [format-string-exploitation](../format-string-exploitation/SKILL.md) — primary method for leaking canary, PIE, libc addresses
9- [heap-exploitation](../heap-exploitation/SKILL.md) — heap attacks for RELRO bypass (when GOT is read-only)
10- [arbitrary-write-to-rce](../arbitrary-write-to-rce/SKILL.md) — what to overwrite when GOT is protected by RELRO
11 
12### Advanced Reference
13 
14Load [PROTECTION_BYPASS_MATRIX.md](./PROTECTION_BYPASS_MATRIX.md) for comprehensive protection × bypass × primitive matrix.
15 
16---
17 
18## 1. PROTECTION IDENTIFICATION
19 
20```bash
21$ checksec ./binary
22[*] '/path/to/binary'
23    Arch:     amd64-64-little
24    RELRO:    Full RELRO          ← GOT read-only
25    Stack:    Canary found        ← stack canary enabled
26    NX:       NX enabled          ← stack not executable
27…