<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-binary-protection-analysis
description: >-
  Analyze binary protections including NX, ASLR, PIE, RELRO, stack canaries, Fortify Source, and RPATH/RUNPATH to assess exploitability and select appropriate bypass techniques.
domain: cybersecurity
subdomain: binary-exploitation
tags:
  - checksec
  - binary-analysis
  - nx
  - pie
  - relro
  - fortify
  - protections
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1518.001"]
  cwe: []
  tools: ["checksec", "readelf", "LIEF", "pwntools", "file"]
---

# Performing Binary Protection Analysis

## Overview

Analyze binary protections including NX, ASLR, PIE, RELRO, stack canaries, Fortify Source, and RPATH/RUNPATH to assess exploitability and select appropriate bypass techniques.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `checksec` | Security tooling |
| `readelf` | Security tooling |
| `pwntools` | Security tooling |
| `LIEF (optional)` | Security tooling |
| Target binary with identified vulnerability | Environment requirement |
| Isolated lab environment for testing | Environment requirement |
| Authorization and signed Rules of Engagement (RoE) | Environment requirement |

## Workflow

### Step 1: Run checksec Analysis

```bash
# Full protection analysis
checksec --file=./vuln
checksec --dir=/usr/bin/ --output=json

# Manual verification with readelf
readelf -l ./vuln | grep GNU_STACK     # NX
readelf -d ./vuln | grep BIND_NOW      # Full RELRO
readelf -h ./vuln | grep Type          # PIE (DYN = PIE)
readelf -s ./vuln | grep __stack_chk   # Stack canary
```

### Step 2: Analyze with pwntools

```python
from pwn import *

elf = ELF("./vuln")

protections = {
    "arch": elf.arch,
    "bits": elf.bits,
    "endian": elf.endian,
    "nx": elf.nx,
    "pie": elf.pie,
    "canary": elf.canary,
    "relro": elf.relro,
    "rpath": elf.rpath,
    "runpath": elf.runpath,
    "fortify": bool(elf.symbols.get("__fortify_fail")),
}

for k, v in protections.items():
    status = "\033[32m✓\033[0m" if v else "\033[31m✗\033[0m"
    print(f"  {status} {k}: {v}")
```

### Step 3: Assess Exploitability

```python
from pwn import *

elf = ELF("./vuln")

bypass_needed = []
if elf.nx:
    bypass_needed.append("NX → use ROP/ret2libc instead of shellcode")
if elf.pie:
    bypass_needed.append("PIE → need info leak for code base")
if elf.canary:
    bypass_needed.append("Canary → leak or brute-force before overflow")
if elf.relro == "Full":
    bypass_needed.append("Full RELRO → GOT is read-only, target elsewhere")
else:
    bypass_needed.append("Partial RELRO → GOT overwrite viable")

print("Exploitation strategy:")
for b in bypass_needed:
    print(f"  • {b}")
```

## Detection

```yaml
title: Binary Protection Analysis Detection
id: 936c90a4-3df2-4074-8173-4d2afc6473b0
status: experimental
description: Detects suspicious activity related to performing binary protection analysis techniques in binary exploitation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*binary*"
  condition: selection
level: critical
tags:
  - attack.t1518.001
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Binary Protection Analysis Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1518.001 |

## Verification

- [ ] All binary protections enumerated
- [ ] Exploitability assessment complete
- [ ] Bypass strategy identified for each protection
- [ ] Report generated with protection matrix

## References

- [checksec](https://github.com/slimm609/checksec.sh)
- [LIEF](https://lief-project.github.io/)
