> For the complete documentation index, see [llms.txt](https://hacktricks.xsx.tw/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacktricks.xsx.tw/binary-exploitation.md).

# Binary Exploitation

- [Basic Binary Exploitation Methodology](https://hacktricks.xsx.tw/binary-exploitation/basic-binary-exploitation-methodology.md)
- [ELF Basic Information](https://hacktricks.xsx.tw/binary-exploitation/basic-binary-exploitation-methodology/elf-tricks.md)
- [Exploiting Tools](https://hacktricks.xsx.tw/binary-exploitation/basic-binary-exploitation-methodology/tools.md)
- [PwnTools](https://hacktricks.xsx.tw/binary-exploitation/basic-binary-exploitation-methodology/tools/pwntools.md)
- [Stack Overflow](https://hacktricks.xsx.tw/binary-exploitation/stack-overflow.md)
- [Pointer Redirecting](https://hacktricks.xsx.tw/binary-exploitation/stack-overflow/pointer-redirecting.md)
- [Ret2win](https://hacktricks.xsx.tw/binary-exploitation/stack-overflow/ret2win.md)
- [Ret2win - arm64](https://hacktricks.xsx.tw/binary-exploitation/stack-overflow/ret2win/ret2win-arm64.md)
- [Stack Shellcode](https://hacktricks.xsx.tw/binary-exploitation/stack-overflow/stack-shellcode.md)
- [Stack Shellcode - arm64](https://hacktricks.xsx.tw/binary-exploitation/stack-overflow/stack-shellcode/stack-shellcode-arm64.md)
- [Stack Pivoting - EBP2Ret - EBP chaining](https://hacktricks.xsx.tw/binary-exploitation/stack-overflow/stack-pivoting-ebp2ret-ebp-chaining.md)
- [Uninitialized Variables](https://hacktricks.xsx.tw/binary-exploitation/stack-overflow/uninitialized-variables.md)
- [ROP - Return Oriented Programing](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing.md)
- [BROP - Blind Return Oriented Programming](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/brop-blind-return-oriented-programming.md)
- [Ret2csu](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/ret2csu.md)
- [Ret2dlresolve](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/ret2dlresolve.md)
- [Ret2esp / Ret2reg](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/ret2esp-ret2reg.md)
- [Ret2lib](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/ret2lib.md)
- [Leaking libc address with ROP](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address.md)
- [Leaking libc - template](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/ret2lib/rop-leaking-libc-address/rop-leaking-libc-template.md)
- [One Gadget](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/ret2lib/one-gadget.md)
- [Ret2lib + Printf leak - arm64](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/ret2lib/ret2lib-+-printf-leak-arm64.md)
- [Ret2syscall](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/rop-syscall-execv.md)
- [Ret2syscall - ARM64](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/rop-syscall-execv/ret2syscall-arm64.md)
- [Ret2vDSO](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/ret2vdso.md)
- [SROP - Sigreturn-Oriented Programming](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming.md)
- [SROP - ARM64](https://hacktricks.xsx.tw/binary-exploitation/rop-return-oriented-programing/srop-sigreturn-oriented-programming/srop-arm64.md)
- [Array Indexing](https://hacktricks.xsx.tw/binary-exploitation/array-indexing.md)
- [Integer Overflow](https://hacktricks.xsx.tw/binary-exploitation/integer-overflow.md)
- [Format Strings](https://hacktricks.xsx.tw/binary-exploitation/format-strings.md)
- [Format Strings - Arbitrary Read Example](https://hacktricks.xsx.tw/binary-exploitation/format-strings/format-strings-arbitrary-read-example.md)
- [Format Strings Template](https://hacktricks.xsx.tw/binary-exploitation/format-strings/format-strings-template.md)
- [Heap](https://hacktricks.xsx.tw/binary-exploitation/heap.md)
- [Use After Free](https://hacktricks.xsx.tw/binary-exploitation/heap/use-after-free.md)
- [Heap Overflow](https://hacktricks.xsx.tw/binary-exploitation/heap/heap-overflow.md)
- [Common Binary Exploitation Protections & Bypasses](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses.md)
- [ASLR](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses/aslr.md)
- [Ret2plt](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses/aslr/ret2plt.md)
- [Ret2ret & Reo2pop](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses/aslr/ret2ret.md)
- [CET & Shadow Stack](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses/cet-and-shadow-stack.md)
- [Libc Protections](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses/libc-protections.md)
- [Memory Tagging Extension (MTE)](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses/memory-tagging-extension-mte.md)
- [No-exec / NX](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses/no-exec-nx.md)
- [PIE](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses/pie.md)
- [BF Addresses in the Stack](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses/pie/bypassing-canary-and-pie.md)
- [Relro](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses/relro.md)
- [Stack Canaries](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses/stack-canaries.md)
- [BF Forked & Threaded Stack Canaries](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/bf-forked-stack-canaries.md)
- [Print Stack Canary](https://hacktricks.xsx.tw/binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/print-stack-canary.md)
- [Write What Where 2 Exec](https://hacktricks.xsx.tw/binary-exploitation/write-what-where-2-exec.md)
- [WWW2Exec - atexit()](https://hacktricks.xsx.tw/binary-exploitation/write-what-where-2-exec/www2exec-atexit.md)
- [WWW2Exec - .dtors & .fini\_array](https://hacktricks.xsx.tw/binary-exploitation/write-what-where-2-exec/www2exec-.dtors-and-.fini_array.md)
- [WWW2Exec - GOT/PLT](https://hacktricks.xsx.tw/binary-exploitation/write-what-where-2-exec/aw2exec-got-plt.md)
- [WWW2Exec - \_\_malloc\_hook](https://hacktricks.xsx.tw/binary-exploitation/write-what-where-2-exec/aw2exec-__malloc_hook.md)
- [Common Exploiting Problems](https://hacktricks.xsx.tw/binary-exploitation/common-exploiting-problems.md)
- [Windows Exploiting (Basic Guide - OSCP lvl)](https://hacktricks.xsx.tw/binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.md)
- [Linux Exploiting (Basic) (SPA)](https://hacktricks.xsx.tw/binary-exploitation/linux-exploiting-basic-spa.md)