abelrguezr/pie-exploitation
skills/binary-exploitation/common-binary-protections-and-bypasses/pie/pie/SKILL.md
How to exploit Position Independent Executable (PIE) binaries by leaking addresses and calculating offsets. Use this skill whenever the user mentions PIE binaries, position-independent executables, address randomization, ASLR bypass, binary exploitation, CTF challenges with PIE, or needs to calculate base addresses from leaked addresses. Make sure to use this skill for any binary exploitation task involving memory addresses, even if the user doesn't explicitly mention PIE.
$ install --global
skillsauthnpx skillsauth add abelrguezr/hacktricks-skills pie-exploitationInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 2:09 AM14.9s3 files scanned
SKILL.md
- name:
- pie-exploitation
- description:
- How to exploit Position Independent Executable (PIE) binaries by leaking addresses and calculating offsets. Use this skill whenever the user mentions PIE binaries, position-independent executables, address randomization, ASLR bypass, binary exploitation, CTF challenges with PIE, or needs to calculate base addresses from leaked addresses. Make sure to use this skill for any binary exploitation task involving memory addresses, even if the user doesn't explicitly mention PIE.
PIE Exploitation Guide
This skill helps you exploit Position Independent Executable (PIE) binaries by understanding how to leak addresses and calculate offsets to bypass address randomization.
Understanding PIE
Position Independent Executable (PIE) means the program can load at different memory locations each time it's executed. This prevents hardcoded addresses from working across runs.
Key Concept: Relative Addresses
The trick to exploiting PIE binaries is exploiting relative addresses—the offsets between parts of the program remain the same even if absolute locations change.
To bypass PIE, you only need to leak one address, typically from the stack using vulnerabilities like format string attacks. Once you have an address, you can calculate others by their fixed offsets.
Base Address Calculation
Page Alignment Hint
PIE base addresses typically end in 000 (hex) because memory pages are the units of randomization, sized at 0x1000 bytes.
Example:
- If you leak an address at
0x649e1024 - The base address is
0x649e1000(mask off the last 3 hex digits) - From there, calculate offsets of functions and locations
Quick Calculation
leaked_address = 0x649e1024
base_address = leaked_address & ~0xFFF # = 0x649e1000
Bypass Methods
1. Disabled ASLR
If ASLR is disabled, a PIE binary always loads at the same address, making PIE useless. Check with:
readelf -l binary | grep "Type"
# or
checksec --file=binary
2. Given Leak (CTF Challenges)
In easy CTF challenges, you may be given the leak directly. Use it to calculate the base address and proceed with your exploit.
3. Brute-Force Stack Values
Brute-force EBP and EIP values in the stack until you leak the correct ones. This is less reliable but can work in some scenarios.
4. Format String Vulnerability (Most Common)
Use an arbitrary read vulnerability like format string to leak an address from the stack:
# Example format string leak
payload = "%7$p" # Leak 7th stack value
response = send_receive(payload)
leaked_addr = parse_address(response)
base_addr = leaked_addr & ~0xFFF
Exploitation Workflow
- Identify PIE binary: Check if the binary is compiled as PIE
- Find a leak primitive: Format string, arbitrary read, or other vulnerability
- Leak one address: Get any address from the binary's memory space
- Calculate base address: Mask off the last 3 hex digits (align to page)
- Calculate target addresses: Add known offsets to base address
- Execute exploit: Use calculated addresses in your payload
Common Offsets to Know
- GOT entries: Usually in
.got.pltsection, fixed offset from base - PLT stubs: In
.pltsection, fixed offset from base - Functions: In
.textsection, fixed offset from base - Global variables: In
.data/.bss, fixed offset from base
Use readelf -s binary or objdump -t binary to find offsets.
Debugging Tips
Check if Base Address is Correct
If your exploit isn't working, verify the base address:
- It should end in
000(page-aligned) - Compare with expected ranges for your architecture
- Use GDB to confirm:
info proc mappings
GDB Commands for PIE
# After the program starts
info proc mappings
# Look for the binary's base address
# Or use
info sections
# Shows section addresses relative to base
Example Exploit Structure
from pwn import *
# Connect to target
p = process('./vuln')
# Leak an address (example: format string)
leaked = leak_address(p)
# Calculate base
base = leaked & ~0xFFF
# Calculate target function address
system_addr = base + 0x4521 # offset from readelf
# Build payload with calculated address
payload = b'A' * 72 + p64(system_addr)
# Send exploit
p.sendline(payload)
When to Use This Skill
Use this skill when:
- You're working with a binary that has PIE enabled
- You need to calculate addresses for an exploit
- You've leaked an address and need to find the base
- You're debugging why an exploit isn't working (check base address alignment)
- You're solving CTF challenges involving PIE binaries
- You need to understand how to bypass address randomization
References
- ir0nstone PIE notes
- PIE bypass example
- PIE exploit example
Related Skills
abelrguezr/house-of-lore-exploit
testing
VerifiedTrustedCommunity
How to perform a House of Lore (small bin attack) heap exploitation. Use this skill whenever the user mentions heap exploitation, small bin attacks, fake chunks, glibc heap vulnerabilities, or needs to insert fake chunks into small bins for arbitrary read/write. Trigger for CTF challenges involving heap corruption, glibc 2.31+ exploitation, or when the user needs to bypass malloc sanity checks using fake chunk linking.
5SKILL.mdUpdated Apr 16, 2026
abelrguezr/house-of-force-exploit
testing
VerifiedTrustedCommunity
How to perform House of Force heap exploitation attacks. Use this skill whenever the user mentions heap exploitation, House of Force, top chunk manipulation, arbitrary memory allocation, malloc manipulation, or wants to allocate chunks at specific addresses. Also trigger for CTF challenges involving heap overflows, top chunk size overwrites, or when the user needs to calculate evil_size for heap attacks. Make sure to use this skill for any binary exploitation task involving glibc heap manipulation, even if they don't explicitly say "House of Force".
5SKILL.mdUpdated Apr 16, 2026
abelrguezr/house-of-einherjar
tools
VerifiedTrustedCommunity
How to perform House of Einherjar heap exploitation to allocate memory at arbitrary addresses. Use this skill whenever the user mentions heap exploitation, glibc heap attacks, arbitrary memory allocation, off-by-one overflow exploitation, tcache poisoning, fast bin attacks, or any CTF challenge involving heap manipulation. This is essential for binary exploitation tasks where you need to control malloc() return addresses.
5SKILL.mdUpdated Apr 16, 2026
abelrguezr/heap-overflow-exploitation
testing
VerifiedTrustedCommunity
How to identify, analyze, and exploit heap overflow vulnerabilities in binary exploitation challenges and real-world scenarios. Use this skill whenever the user mentions heap overflows, memory corruption, heap grooming, tcache poisoning, fast-bin attacks, or any heap-related vulnerability in CTF challenges, binary analysis, or security research. This skill covers heap overflow fundamentals, exploitation techniques, heap grooming strategies, and real-world CVE analysis.
5SKILL.mdUpdated Apr 16, 2026