| Attribute | Detailed Description |
|---|---|
| Architecture | The binary is for a 64-bit architecture and uses little-endian byte ordering, where the least significant byte is stored first. |
| RELRO | No RELRO protection is enabled. When Full RELRO is enabled, the Global Offset Table (GOT) becomes read-only, preventing attacks like GOT overwriting. Without RELRO, the GOT is writable at runtime, making it vulnerable. |
| Stack Canary | Stack canaries help detect stack buffer overflow attacks by placing a known value (canary) before the return address on the stack. If the canary is altered, it indicates a buffer overflow, and the program terminates. Without stack canaries, the binary is vulnerable to stack overflow attacks. |
| NX (No-eXecute) | NX marks memory regions like the stack and data segments as non-executable, preventing injected shellcode from being executed. With NX enabled, typical buffer overflow attacks that inject and execute shellcode are more difficult to perform. |
| PIE (Position Independent Executable) | Without PIE, the binary's code and data segments are loaded at fixed addresses, making them predictable targets for ROP attacks. With PIE, addresses are randomized each time the binary is executed, making it harder for attackers to predict addresses of functions or gadgets. |
| Shadow Stack (SHSTK) | SHSTK is an additional stack that stores return addresses separately. It compares the return address on the shadow stack with the one on the normal stack to detect tampering. If a mismatch is detected, the program will terminate, protecting against return address manipulation attacks. |
| Indirect Branch Tracking (IBT) | IBT adds control-flow integrity checks for indirect branches (e.g., call or jmp instructions) to prevent attackers from redirecting execution to unintended or malicious code. |
| Stripped | The binary is not stripped, meaning it still contains debugging symbols and function names. This makes it easier to analyze and debug, but it also reveals more information to attackers. |