GCC

By default, modern versions of GCC produce Position-Independent Executable (PIE) binaries as a security measure which makes the program’s memory layout unpredictable each time it runs, helping to prevent exploits such as buffer overflows and return-oriented programming (ROP) attacks. Using the -no-pie flag removes this protection, resulting in a fixed memory layout that is easier to analyze and debug. This option is useful for reverse engineering, disassembly, or learning how executables are structured, but it should never be used in production builds, since it reduces the program’s resilience against memory-based attacks.

root@dev:~$ nasm -f elf64 -g -F dwarf hello.asm -o hello.o -l hello4.lst

 * -f elf64 → generates a 64-bit ELF object file for Linux.
 * -g -F dwarf → includes debugging information in DWARF format, which allows tools like gdb to display line numbers, variables, and source-level details.
 * -o hello.o → specifies the output object file.
 * -l hello4.lst → produces a listing file showing assembly alongside machine code.
 
 * Do not use -g -F dwarf in production code.
    - These flags are for debugging and development only; they make the binary 
      larger and expose symbol names and structure information that could aid 
      reverse engineering.

root@dev:~$ gcc hello.o -o hello -no-pie

 * This should only be used for debugging, testing, or learning—not in 
   production—because disabling PIE removes an important layer of memory 
   randomization (ASLR protection), making exploitation easier.

Last updated