Exploit › Module 4 › Lesson 2
PIE RELRO
PIE enables ASLR for executables; RELRO hardens GOT — name both and verify on $PWN_LAB toy builds.
Visual · pwn_pie_relro
PIE/RELRO literacy. $PWN_LAB only. Original Cyberlium.
Opening
Link-time hardening flags change the binary surface — defenders verify, attackers historically studied tables — you verify.
PIE (Position Independent Executable) produces ET_DYN type executables that ASLR can relocate. Full RELRO marks the GOT read-only after dynamic linking setup — reduces some overwrite targets. Partial RELRO leaves GOT writable until init completes. Cyberlium names PIE/RELRO and reads readelf/checksec on YOUR toys at $PWN_LAB — not GOT overwrite recipes. Next: checksec Literacy.
1. PIE (named)
Compile with -fPIE -pie for relocatable main executable. readelf -h shows Type: DYN for PIE binary vs EXEC for classic fixed-base.
On $PWN_LAB, rebuild same toy with and without -pie — log Type field difference in notes.
Command guide
Try these commands — PIE (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
PIE — https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html#index-fPIE RELRO — https://man7.org/linux/man-pages/man1/objdump.1.html (BIND_NOW literacy) Microsoft SDL — https://learn.microsoft.com/en-us/security/sdl/ (platform parity for DEP/ASLR)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install build-essential sudo apt install binutils
macOS:
Command — copy this
xcode-select --install # or brew install gcc brew install binutils
Built-in (Xcode CLI) or brew install binutils
Windows: Use WSL or MinGW Use WSL binutils
═══ LINUX / macOS ═══
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
gcc -Wall -fPIE -pie -Wl,-z,relro,-z,now -O0 -g -o "$LAB_PWN/bin/bof_pie_relro" "$LAB_PWN/src/bof_safe.c"
readelf -h "$LAB_PWN/bin/bof_pie_relro" | grep -E 'Type|Entry'
readelf -l "$LAB_PWN/bin/bof_pie_relro" | grep -E 'GNU_RELRO|GNU_STACK'
readelf -d "$LAB_PWN/bin/bof_pie_relro" | grep -E 'BIND_NOW|FLAGS'
objdump -p "$LAB_PWN/bin/bof_pie_relro" | grep -E 'RELRO|DYNAMIC' | head -6Primary tools to practice this lesson: gcc, readelf, objdump. Reference sites: PIE (https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html#index-fPIE); RELRO (https://man7.org/linux/man-pages/man1/objdump.1.html); Microsoft SDL (https://learn.microsoft.com/en-us/security/sdl/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. RELRO (named)
Partial RELRO: some GOT entries writable early. Full RELRO (-Wl,-z,relro -Wl,-z,now): GOT read-only after relocation — checksec shows Full RELRO.
Literacy: hardening reduces certain corruption targets; source fixes remain essential.
3. Build comparison habit
Maintain insecure-build vs secure-build toy pairs ONLY in lab VM — compare checksec rows side by side for learning.
Ship: PIE/RELRO card — flag lines, readelf/checksec expected output, secure build recommendation. Next: checksec Literacy.
4. What you ship: PIE/RELRO card for $PWN_LAB
PIE and RELRO definitions, gcc/linker flags, checksec expected strings. Secure vs insecure toy comparison. chmod 600.
5. What you record before the next lesson
Date. PIE/RELRO card. $PWN_LAB named. File t24-m04-l02-pie-relro.txt chmod 600.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
GOT overwrite tutorial on production binary. Ship insecure build as default artifact.
Right
Write PIE/RELRO card with readelf proof from YOUR toy builds. Next: checksec Literacy.
Mission: compare PIE/RELRO builds
1) Rebuild toy with -fPIE -pie and RELRO flags. 2) Log readelf Type and checksec RELRO line. 3) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Side-by-side checksec rows make hardening tangible.
Knowledge Check
APPLY: PIE enables:
Multiple choice
Knowledge Check
APPLY: True or False: Full RELRO makes GOT read-only after init.
True or False
Knowledge Check
APPLY: Typical secure link flags include:
Multiple choice