Security Engineering · Cluster
Binary Exploitation
Memory corruption and mitigation design.
- 01 Stack Frame Layout and Why a Linear Overflow Reaches the Return Address How the System V x86-64 frame places locals, the saved frame pointer, and the return address, and why writing past a buffer lands on control data.
- 02 How the PLT and GOT Turn a Library Call Into Writable Memory Lazy binding keeps resolution out of process startup by routing calls through a stub that patches a table, which leaves a writable function pointer for every imported symbol.
- 03 NX and the End of Injected Shellcode Marking the stack and heap non-executable removed the simplest payload, and the cost of that removal is paid on every page table entry and every legitimate JIT.
- 04 Return-to-libc and the Argument Staging Problem Reusing an existing function needs its arguments placed where the calling convention expects them, and the stack arithmetic that makes this possible also limits which functions a chain can call.
- 05 Where Address-Space Randomisation Gets Its Entropy Which regions are randomised, how many bits of entropy each actually receives, and why a single leaked pointer can undo the whole arrangement.
- 06 Stack Canaries and the Value That Terminates the Overflow A per-process guard word placed between the buffer and the saved return address converts a silent hijack into a detected abort, and its design depends on which byte patterns an overflow cannot write.
- 07 How a Format String Becomes an Arbitrary Write The %n conversion stores a count through a pointer the caller supplies on the stack, and variadic argument handling makes that pointer reachable from the format itself.
- 08 Heap Chunk Metadata and Why tcache Changed the Exploit Shape How glibc lays out an allocated chunk, what the free-list pointers in a freed chunk mean, and how a per-thread cache with no consolidation turned a single overflow into an arbitrary allocation.
- 09 Gadget Chains as a Programming Language, and What CFI Restricts A chain of short instruction sequences ending in ret is computationally complete, and control-flow integrity is an attempt to bound where those sequences may begin and end.
- 10 Shadow Stacks, Pointer Authentication, and Memory Tagging in Silicon Three hardware answers to memory corruption differ in what they protect and what they cost: a second return stack, signed pointers, and per-allocation tags checked on every access.