Cyberlium

Exploit › Module 4 › Lesson 2

BeginnerModule 4Lesson 2/5

PIE RELRO

PIE enables ASLR for executables; RELRO hardens GOT — name both and verify on $PWN_LAB toy builds.

15 min+40 XP3 quiz
Module progress2 of 5

Visual · pwn_pie_relro

PIE/RELRO literacy. $PWN_LAB only. Original Cyberlium.

Opening

Link-time hardening flags change the binary surface — defenders verify, attackers historically studied tables — you verify.

PIE (Position Independent Executable) produces ET_DYN type executables that ASLR can relocate. Full RELRO marks the GOT read-only after dynamic linking setup — reduces some overwrite targets. Partial RELRO leaves GOT writable until init completes. Cyberlium names PIE/RELRO and reads readelf/checksec on YOUR toys at $PWN_LAB — not GOT overwrite recipes. Next: checksec Literacy.

1. PIE (named)

Compile with -fPIE -pie for relocatable main executable. readelf -h shows Type: DYN for PIE binary vs EXEC for classic fixed-base.

On $PWN_LAB, rebuild same toy with and without -pie — log Type field difference in notes.

Command guide

Try these commands — PIE (named)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

PIE — https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html#index-fPIE RELRO — https://man7.org/linux/man-pages/man1/objdump.1.html (BIND_NOW literacy) Microsoft SDL — https://learn.microsoft.com/en-us/security/sdl/ (platform parity for DEP/ASLR)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install build-essential
sudo apt install binutils

macOS:

Command — copy this

xcode-select --install  # or brew install gcc
brew install binutils

Built-in (Xcode CLI) or brew install binutils

Windows: Use WSL or MinGW Use WSL binutils

═══ LINUX / macOS ═══

Command — copy this

export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
gcc -Wall -fPIE -pie -Wl,-z,relro,-z,now -O0 -g -o "$LAB_PWN/bin/bof_pie_relro" "$LAB_PWN/src/bof_safe.c"
readelf -h "$LAB_PWN/bin/bof_pie_relro" | grep -E 'Type|Entry'
readelf -l "$LAB_PWN/bin/bof_pie_relro" | grep -E 'GNU_RELRO|GNU_STACK'
readelf -d "$LAB_PWN/bin/bof_pie_relro" | grep -E 'BIND_NOW|FLAGS'
objdump -p "$LAB_PWN/bin/bof_pie_relro" | grep -E 'RELRO|DYNAMIC' | head -6

Primary tools to practice this lesson: gcc, readelf, objdump. Reference sites: PIE (https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html#index-fPIE); RELRO (https://man7.org/linux/man-pages/man1/objdump.1.html); Microsoft SDL (https://learn.microsoft.com/en-us/security/sdl/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. RELRO (named)

Partial RELRO: some GOT entries writable early. Full RELRO (-Wl,-z,relro -Wl,-z,now): GOT read-only after relocation — checksec shows Full RELRO.

Literacy: hardening reduces certain corruption targets; source fixes remain essential.

3. Build comparison habit

Maintain insecure-build vs secure-build toy pairs ONLY in lab VM — compare checksec rows side by side for learning.

Ship: PIE/RELRO card — flag lines, readelf/checksec expected output, secure build recommendation. Next: checksec Literacy.

4. What you ship: PIE/RELRO card for $PWN_LAB

PIE and RELRO definitions, gcc/linker flags, checksec expected strings. Secure vs insecure toy comparison. chmod 600.

5. What you record before the next lesson

Date. PIE/RELRO card. $PWN_LAB named. File t24-m04-l02-pie-relro.txt chmod 600.

6. Wrong vs right: weaponized exploits vs memory-safety literacy

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

  • Wrong

    GOT overwrite tutorial on production binary. Ship insecure build as default artifact.

  • Right

    Write PIE/RELRO card with readelf proof from YOUR toy builds. Next: checksec Literacy.

Mission: compare PIE/RELRO builds

1) Rebuild toy with -fPIE -pie and RELRO flags. 2) Log readelf Type and checksec RELRO line. 3) chmod 600.

Stuck? Ask Cyberlium AI Mentor

Side-by-side checksec rows make hardening tangible.

Knowledge Check

1

APPLY: PIE enables:

Multiple choice

Knowledge Check

2

APPLY: True or False: Full RELRO makes GOT read-only after init.

True or False

Knowledge Check

3

APPLY: Typical secure link flags include:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)