> There are certain scenarios that SSP is not used, such as with arrays that are less than 8 items wide if I remember right. You can also bypass SSP if you find

> There are certain scenarios that SSP is not used, such as with arrays that are less than 8 items wide if I remember right. You can also bypass SSP if you find a separate memory disclosure vulnerability and learn the stack cookie. -fstack-protector-strong always does it when there's an array. Many distributions lowered the minimum array size for -fstack-protector to 4 bytes too. > A good trick is to use rop gadgets to allocate a memory region with read-write-execute permissions, copy some executable code into it, and then jump into it. Note that this is why PaX's MPROTECT feature exists. It prevents injecting code or bypassing RELRO by default and executables need to be marked with exceptions for stuff like JIT compilation to work.