Fortify Sanitize

FORTIFY_SOURCE wraps libc calls; AddressSanitizer catches heap bugs at test time — run on YOUR $PWN_LAB toys in CI and local test.

Fortify Sanitize• Audio Walkthrough

00:00/03:12

Visual · pwn_fortify_sanitize

Fortify/sanitize literacy. $PWN_LAB only. Original Cyberlium.

Compile-time FORTIFY and test-time ASan turn silent corruption into loud failures — use both.

_FORTIFY_SOURCE=2 with -O2 adds bounds checks to selected libc functions at compile time — failures abort with clear message. AddressSanitizer (-fsanitize=address) instruments allocations in test binaries — slows down, catches UAF/overflow during development. Cyberlium runs ASan builds on YOUR toys at $PWN_LAB before merging fixes — not as a step toward weaponization. Next: Safe APIs.

1. FORTIFY_SOURCE (named)

Requires -O2 (or -O3) and glibc. Catches some compile-time-known overflow sizes in strcpy-like wrappers — not a substitute for safe coding.

On $PWN_LAB, trigger FORTIFY abort on toy BOF — observe message; fix with bounded copy; rebuild clean.

Command guide

Try these commands — FORTIFY_SOURCE (named)

═══ LINUX (Binary Analysis & Reverse Engineering) ═══

Disassemble main function using Intel assembly syntax

Command — copy this

objdump -d -M intel -j .text ./target_binary 2>/dev/null | head -30

Check binary security mitigations (NX, Canary, ASLR, PIE)

Command — copy this

checksec --file=./target_binary 2>/dev/null || readelf -l ./target_binary | grep GNU_STACK

Generate unique cyclic pattern for buffer overflow offset calculation

Command — copy this

python3 -c "
from itertools import product
chars = [b'A', b'B', b'C']
pattern = b''.join(b''.join(p) for p in product(b'ABCDEFGHIJKLMNOPQRSTUVWXYZ', b'abcdefghijklmnopqrstuvwxyz', b'0123456789'))[:128]
print('Cyclic Test Pattern (128 bytes):', pattern.decode())
"

GDB debugging session quick start gdb -q ./target_binary (gdb) disassemble main (gdb) info registers

Primary tools to practice this lesson: gcc, curl. Reference sites: FORTIFY_SOURCE (https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-D_005fFORTIFY_005fSOURCE); AddressSanitizer (https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fsanitize_003daddress); Microsoft SDL (https://learn.microsoft.com/en-us/security/sdl/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. AddressSanitizer (named)

Build with -fsanitize=address -g for test target. Run toy UAF demo — ASan prints allocation/free stack. Use ASAN_OPTIONS=log_path for CI artifacts.

Do not ship ASan binaries to production — test-only instrumentation.

3. CI habit

Pipeline: asan test job on toy suite, secure release job with FORTIFY + checksec gate. Failing ASan blocks merge — defender workflow.

Ship: fortify/sanitize card — flags, when to use, sample ASan one-liner from YOUR toy. Next: Safe APIs.

4. What you ship: FORTIFY/ASan card for $PWN_LAB

Flag lines for FORTIFY and ASan. Sample abort/ASan message from toy. Test vs release note. chmod 600.

5. What you record before the next lesson

Date. Fortify/sanitize card. $PWN_LAB named. File t24-m05-l02-fortify-sanitize.txt chmod 600.

6. Wrong vs right: weaponized exploits vs memory-safety literacy

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Disable FORTIFY to 'see raw overflow.' Ship ASan binary as production release.
Right: Document FORTIFY/ASan with sample output from YOUR toy tests. Next: Safe APIs.

Hands-on Exercise