Position-Independent Executable

security memory

Definition

Position-Independent Executable (PIE)

A Position-Independent Executable (PIE) is a binary compiled so that its own code and data segments — .text, .data, .rodata, .plt — are loaded at a runtime-randomised base address rather than at a fixed one. PIE is essentially ASLR applied to the binary itself; without it, ASLR randomises only libraries, heap, and stack, leaving the binary’s segments fixed. With PIE, all addresses inside the binary are also randomised, and attackers cannot assume where anything in the binary lives in memory.

Effect

What PIE closes

Under ASLR alone the binary’s own segments stay put, which keeps ret2plt and in-binary ROP gadgets reachable at fixed addresses. PIE removes that gap: .text and .plt become randomised along with the libraries, so system@plt and the pop rdi; ret gadget inside the binary are at addresses that change every run. As with ASLR, the attacker now needs an information leak or a partial overwrite to find them — PIE pushes the binary onto the same leak/brute-force defence ASLR uses for libraries, so the attack surface against the binary’s own code becomes ASLR-style rather than absolute.

Bypass

The same stance as ASLR

Bypassing PIE uses the same techniques as bypassing ASLR:

• Information leaks — leaking one address inside the binary reveals its base (leaked address minus the symbol’s known offset), and from there every other in-binary address follows. Since the offsets within the binary are fixed at compile time, knowing the binary is enough to know the layout once one address is leaked.
• Partial overwrites — overwriting only the low-order bytes of a saved return address or function pointer can still reach a nearby in-binary gadget if the offset between the saved value and the target happens to fit in those bytes, with the same brute-force feasibility when few bits are unknown.

checksec is the standard tool that reports whether a given binary is compiled with PIE (and the other mitigations — canary, NX, ASLR). Its presence just signals which residual attack class the attacker is forced into: with PIE on, ret2plt is gone and the binary becomes a leak-or-brute-force target, not a fixed-address one.