现代漏洞利用缓解措施与绕过
理解漏洞与可行漏洞利用之间的防御措施：ASLR、DEP/NX、栈金丝雀和 CFG，以及绕过这些防御的基本思路。
现代漏洞利用缓解措施与绕过 是 CoddyKit 上的免费 Reverse Engineering & Binary Analysis Basics 课时。 这是第 4 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Reverse Engineering & Binary Analysis Basics 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Reverse Engineering & Binary Analysis Basics 课程共包含 4 节课。
本课时的部分内容尚未翻译，以英文显示。
Why Exploits Got Harder
You can identify binary vulnerabilities, fuzz for bugs, and understand exploit primitives. Modern systems add mitigations that turn an easy bug into a hard one.
Knowing these defenses tells you what a working exploit must overcome.
Data Execution Prevention (DEP/NX)
DEP (a.k.a. the NX bit) marks memory as non-executable. Code injected onto the stack will not run.
This killed classic 'shellcode on the stack' attacks and pushed exploiters toward code reuse.
Return-Oriented Programming
To bypass DEP, attackers reuse existing executable code. ROP chains together short instruction sequences (gadgets) ending in ret to perform arbitrary actions without injecting code.
; a gadget
pop rdi
ret
; chained: set rdi, then call a real functionAddress Space Layout Randomization
ASLR randomizes where modules, stack, and heap load each run, so attackers cannot hardcode addresses.
Without a known address, both shellcode and ROP gadgets are hard to target.
Defeating ASLR with Leaks
ASLR is bypassed with an information leak: a bug that discloses a real runtime address. From one leaked pointer you compute the module base and locate your gadgets.
Many modern exploits are really 'leak then exploit' two-stage attacks.
Stack Canaries
A stack canary is a random value placed before the saved return address. A linear stack overflow overwrites it, and the function aborts on mismatch.
; epilogue check
mov rax, [rbp-8]
xor rax, fs:[0x28]
jne __stack_chk_failBypassing Canaries
Canaries are defeated by:
- Leaking the canary value, then writing it back unchanged
- Overwriting structures that skip the check (e.g. a non-linear write)
This is why info leaks are so valuable.
Control-Flow Integrity
CFI and Windows' CFG validate indirect calls and returns against a set of legitimate targets, breaking many ROP chains.
Hardware features like Intel CET add a shadow stack to protect return addresses.
RELRO and Fortify
Other hardening you will encounter:
- Full RELRO makes the GOT read-only, blocking GOT-overwrite tricks
- FORTIFY_SOURCE adds bounds checks to common functions
Check which are enabled before planning an approach.
checksec --file=./target
# RELRO: Full Canary: Yes NX: Yes PIE: YesThe Mitigation Mindset
Exploit development is an enumerate-then-bypass process: list active mitigations, then find the bug or leak that neutralizes each. Strong defenses do not make exploitation impossible, only more demanding.
PIE and Position Independence
PIE (Position Independent Executable) lets ASLR randomize the main binary itself, not just libraries. Without PIE, the executable loads at a fixed base, giving attackers reliable gadget addresses.
checksec reporting 'PIE: No' is a meaningful weakness worth noting.
Quick Check
Which technique is specifically designed to bypass DEP/NX by reusing existing executable code instead of injecting new code?
Recap
You now map the modern defensive landscape:
- DEP/NX blocks injected code; ROP reuses existing code
- ASLR randomizes addresses; info leaks defeat it
- Canaries, CFI/CFG, RELRO add further hurdles
Real exploitation means enumerating these and chaining bugs to bypass each.
常见问题解答
「现代漏洞利用缓解措施与绕过」课时是免费的吗？
是的 — 「现代漏洞利用缓解措施与绕过」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Reverse Engineering & Binary Analysis Basics 课程的其余内容，请升级到 CoddyKit PRO。 Reverse Engineering & Binary Analysis Basics 课程共包含 4 节课。
「现代漏洞利用缓解措施与绕过」这节课中我会学到什么？
理解漏洞与可行漏洞利用之间的防御措施：ASLR、DEP/NX、栈金丝雀和 CFG，以及绕过这些防御的基本思路。 你通过在浏览器中直接运行的动手代码来练习 Reverse Engineering & Binary Analysis Basics，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 Reverse Engineering & Binary Analysis Basics 需要有经验吗？
无需任何先前经验。CoddyKit 上的 Reverse Engineering & Binary Analysis Basics 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 4 节课，共 4 节。
「现代漏洞利用缓解措施与绕过」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 Reverse Engineering & Binary Analysis Basics 课中编写并运行代码吗？
能。每节 Reverse Engineering & Binary Analysis Basics 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。