What is binary exploitation?
When a program mishandles memory — reads or writes past the end of a buffer, uses freed memory, or misinterprets attacker-controlled data — an attacker may be able to overwrite sensitive structures such as return addresses, function pointers, or heap metadata to redirect execution flow. The core goal is almost always the same: control the instruction pointer (EIP/RIP on x86, LR/PC on ARM) so arbitrary code runs in the context of the target process.Key vulnerability classes
Stack Overflow
Writing past the end of a stack buffer, overwriting the saved return address and achieving control flow hijacking.
Return-Oriented Programming
Chaining existing code gadgets to build arbitrary computation without injecting new code.
Heap Exploitation
Abusing allocator internals — use-after-free, double-free, and bin attacks — to redirect execution or corrupt data.
Format String
Exploiting unchecked
printf-family calls to read from or write to arbitrary memory addresses. See stack-based techniques for exploitation primitives.Common binary protections
Modern toolchains and operating systems ship several mitigations. Understanding them is prerequisite to defeating them.Stack Canaries
Stack Canaries
A randomised value placed between the local variables and the saved return address. Before the function returns, the runtime checks that the canary is intact. Any linear stack overflow that overwrites the return address will corrupt the canary and trigger an abort.Bypasses: information leak to read the canary, bruteforcing in forking servers (one byte at a time), or exploits that skip the canary entirely (e.g., format strings targeting the return address directly).
ASLR — Address Space Layout Randomisation
ASLR — Address Space Layout Randomisation
The OS randomises the base addresses of the stack, heap, and shared libraries on each execution. Without knowing where code lives an attacker cannot hardcode gadget addresses.Bypasses: information leaks (format strings, partial overwrites), brute force (32-bit), or targets with ASLR disabled.
NX / DEP — Non-Executable Stack
NX / DEP — Non-Executable Stack
Pages are marked either writable or executable but not both. Shellcode placed on the stack cannot be directly executed.Bypass: Return-Oriented Programming (ROP) — reuse existing executable code.
PIE — Position Independent Executable
PIE — Position Independent Executable
The main binary itself is loaded at a randomised base address (like a shared library), extending ASLR to the executable’s own code and GOT.Bypasses: information leak of a code pointer, partial overwrites using only the low bytes of an address.
RELRO — Relocation Read-Only
RELRO — Relocation Read-Only
Full RELRO makes the GOT (Global Offset Table) read-only after dynamic linking, preventing overwrite attacks that redirect PLT calls.Partial RELRO only protects some segments; full RELRO is the stronger form.
Enabling core dumps for debugging
When developing or analysing an exploit, core files capture the exact memory state of a crashed process./etc/security/limits.conf:
Exploit development workflow
Identify the vulnerability
Fuzz the target, review source code, or reverse engineer to find where user input can overflow a buffer, trigger a use-after-free, or cause another memory error.
Determine what you control
Work out which registers or memory locations you can influence and to what extent. A De Bruijn sequence (cyclic pattern) is the standard way to measure the exact offset to the return address.
Plan a bypass chain
Select the appropriate technique for the protection set: ROP for NX, info-leak for ASLR/PIE, heap grooming for canary bypass in forking servers, and so on.
Essential tools
| Tool | Purpose |
|---|---|
pwntools | Python exploit-development framework — packing, ROP, process/socket interaction |
GDB + GEF / pwndbg | Dynamic analysis with heap visualisation and pattern generation |
ROPgadget / ropper | Static gadget search in ELF binaries and libraries |
checksec | Enumerate binary protections |
ltrace / strace | Trace library and system calls at runtime |
| Ghidra / IDA | Reverse engineering and static analysis |
All the techniques in this section assume a Linux/ELF target unless stated otherwise. Windows exploitation (SEH overflows, WoW64, kernel) is covered under the platform-specific pages.