Exploit › Module 5 › Lesson 1
Compiler Flags
Compiler and linker flags enable stack protection, FORTIFY, PIE, and RELRO — document secure defaults for YOUR $PWN_LAB toy Makefile.
Visual · pwn_compiler_flags
Compiler flag literacy. $PWN_LAB only. Original Cyberlium.
Opening
Secure builds start at gcc/clang command line — flags you enable beat regrets after CVE.
Typical hardening for C toys on Linux: -O2 -Wall -Wextra -Wformat-security -fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE -pie -Wl,-z,relro -Wl,-z,now. Contrast builds omit subsets ONLY inside $PWN_LAB VM for checksec learning — never ship weak flags to production. Cyberlium documents flag literacy on YOUR Makefile at $PWN_LAB — not flag-stripping for exploitation. Next: Fortify/Sanitize.
1. Core warning and hardening flags
-Wall -Wextra -Werror (in CI): catch suspicious patterns early. -Wformat-security: warn on non-literal printf formats. -fstack-protector-strong: emit canaries on vulnerable functions.
On $PWN_LAB, store SECURE_FLAGS variable in Makefile; log diff when temporarily removed for contrast build inside VM.
Command guide
Try these commands — Core warning and hardening flags
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GCC Instrumentation — https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html Microsoft SDL — https://learn.microsoft.com/en-us/security/sdl/ (compiler flag parity) checksec — https://github.com/slimm609/checksec.sh (verify flag outcomes)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install build-essential
macOS:
Command — copy this
xcode-select --install # or brew install gcc
Windows: Use WSL or MinGW
═══ LINUX / macOS ═══
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
cat > "$LAB_PWN/notes/compiler-flags.txt" <<'EOF'
hardening flags (YOUR toys):
-fstack-protector-strong # stack canary
-D_FORTIFY_SOURCE=2 # compile-time bounds checks on libc calls
-fPIE -pie # position independent executable
-Wl,-z,relro,-z,now # full RELRO / BIND_NOW
EOFCommand — copy this
grep -E 'stack-protector|FORTIFY|PIE|relro' "$LAB_PWN/notes/compiler-flags.txt" gcc -Wall -fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE -pie -Wl,-z,relro,-z,now -O0 -g \ -o "$LAB_PWN/bin/flags_demo" "$LAB_PWN/src/bof_safe.c" file "$LAB_PWN/bin/flags_demo"
Primary tools to practice this lesson: gcc, grep. Reference sites: GCC Instrumentation (https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html); Microsoft SDL (https://learn.microsoft.com/en-us/security/sdl/); checksec (https://github.com/slimm609/checksec.sh). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Link-time flags
-fPIE -pie: PIE executable. -Wl,-z,relro -Wl,-z,now: full RELRO. Avoid -z execstack and -no-pie in release builds.
readelf and checksec confirm flags took effect — verification closes the loop.
3. Release vs lab contrast discipline
WEAK_FLAGS target exists only in lab notes for education — tarball release uses SECURE_FLAGS only.
Ship: Makefile snippet with SECURE_FLAGS and one-line purpose per flag group. Next: Fortify/Sanitize.
4. What you ship: SECURE_FLAGS Makefile snippet for $PWN_LAB
SECURE_FLAGS line with annotated purposes. checksec proof after build. NEVER ship WEAK_FLAGS outside VM. chmod 600.
5. What you record before the next lesson
Date. Compiler flags snippet. $PWN_LAB named. File t24-m05-l01-compiler-flags.txt chmod 600.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Default Makefile uses -fno-stack-protector -no-pie for 'easier pwn.' Strip flags on production release.
Right
Document SECURE_FLAGS for YOUR toy Makefile with checksec proof. Next: Fortify/Sanitize.
Mission: freeze SECURE_FLAGS
1) Write SECURE_FLAGS with six+ hardening flags. 2) Annotate each group in comments. 3) Build and note checksec result. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Copy SECURE_FLAGS into every future C lab Makefile.
Knowledge Check
APPLY: Compiler flag literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: -fPIE -pie supports ASLR for executables.
True or False
Knowledge Check
APPLY: Release builds should avoid:
Multiple choice