0x   KNOWLEDGE AREA

Binary exploitation

Memory corruption, heap primitives, and browser engines.

13 topics

Pwnfoundation

Binary triage and mitigation inventory

Before choosing an exploit family, establish the executable format, architecture, ABI, loader, and runtime dependencies.

binary-triagepwn
Pwnintermediate

Dynamic linking, GOT, PLT, and relocation protection

Dynamically linked ELF programs resolve external symbols through relocation records and runtime loader machinery.

dynamic-linkingpwn
Pwnintermediate

Format-string reads, writes, and argument indexing

A format-string vulnerability passes attacker-controlled bytes as the formatting program rather than as a string argument.

format-stringspwn
Pwnadvanced

House of Spirit and allocator version matrix

House of Spirit introduces a fabricated chunk into an allocator free list so a later allocation can return controlled nonheap storage.

house-of-spiritpwn
Pwnintermediate

Integer overflow, truncation, and allocation arithmetic

An arithmetic bug can make the number of bytes allocated differ from the number subsequently accessed.

integer-boundariespwn
Pwnadvanced

JIT aliasing and stale map inference

Reason about object identity across compiler effects before turning layout confusion into a memory primitive.

v8jittype-confusion
Pwnadvanced

Largebin insertion yields a constrained write

Preserve allocator-version paths and distinguish a chosen destination from a chosen value.

glibcheaplargebin
Pwnintermediate

Return-oriented programming and calling conventions

ROP composes existing instruction sequences ending in control transfers.

return-oriented-programmingpwn
Pwnadvanced

Seccomp constraints and syscall-level exploit goals

Seccomp filters restrict system calls using a policy evaluated on syscall number, architecture, and arguments.

seccomp-and-syscallspwn
Pwnintermediate

Stack overflows and precise overwrite offsets

A stack overflow writes beyond a local object into adjacent stack state.

stack-overflowpwn
Pwnadvanced

Tcache and safe-linking: version-sensitive heap state

glibc tcache keeps small freed allocations in per-thread singly linked lists.

tcache-and-safe-linkingpwn
Pwnadvanced

Tcache overlap across consolidation paths

Track physical chunk ownership separately from freelist membership when evaluating double-free checks.

glibctcachedouble-free
Pwnintermediate

Use-after-free: object lifetime and controlled reuse

A use-after-free occurs when a reference survives the end of an allocation lifetime.

use-after-freepwn