Agent skill · security · yaklang
binary-protection-bypass
Binary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF binaries to enable exploitation.
Why this skill is useful
Adds detailed executable scripts and methodologies for bypassing complex binary protections that are not commonly known.
What it needs
Requires checksec installed locally. About 7k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Binary Protection Bypass — Expert Attack Playbook AI LOAD INSTRUCTION: Expert binary protection identification and bypass techniques. Covers ASLR, PIE, NX, RELRO, canary, FORTIFYSOURCE, stack clash, CET shadow stack, and ARM MTE. Each protection is paired with its bypass methods and required primitives. Distilled from ctf-wiki mitigation sections and real-world exploitation. Base models often confuse which protections block which attacks and miss the combinatorial effect of multiple protections. 0. RELATED ROUTING stack-overflow-and-rop — ROP chains to bypass NX, ret2libc for ASLR bypass format-string-exploitation — primary method for leaking canary, PIE, libc addresses heap-exploitation — heap attacks for RELRO bypass (when GOT is read-only) arbitrary-write-to-rce — what to overwrite when GOT is protected by RELRO Advanced Reference Load PROTECTIONBYPASSMATRIX.md for comprehensive protection × bypass × primitive matrix. --- 1. PROTECTION IDENTIFICATION Quick Identification Table Protection Check Command Binary Indicator --- --- --- ASLR cat /proc/sys/kernel/randomizevaspace OS-level (0=off, 1=partial, 2=full) PIE checksec or readelf -h (Type: DYN) Binary compiled with -pie NX checksec or readelf -l (no RWE segment) gcc -z noexecstack (default on) Canary checksec or look for stackchkfail@plt gcc -fstack-protector-all Partial RELRO readelf -l (GNURELRO segment, .got.plt writable) gcc -Wl,-z,relro Full RELRO readelf -l + .got section read-only gcc -Wl,-z,relro,-z,now FORTIFY Presence of printfchk, memcpychk etc. gcc -DFORTIFYSOURCE=2 --- 2. ASLR BYPASS ASLR randomizes base addresses of stack, heap, libc, and mmap regions at each execution. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/binary-protection-bypass