- Published on
Pwn Learning Path #0: From Stack Frames to Advanced Exploitation
- Authors
- Name
- Muhammad Huzaifa
IMPORTANT
Everything in this series is practiced on local labs, CTF challenges, and systems I own or have explicit permission to test.
I am learning pwn by building and debugging small Linux x86_64 programs. The goal is not to collect payloads. It is to understand exactly why control flow changes, what each stack value does, and why an exploit succeeds or crashes.
This post is the index for that journey. I will keep extending it as I move from stack basics into mitigations, format strings, heap exploitation, reversing, and advanced topics.
How I am learning
My loop for every lab is simple:
- Build and run the program normally.
- Check the binary and its mitigations.
- Read the source, then confirm it in disassembly.
- Reproduce the crash in GDB.
- Identify the bug, offset, primitive, and target.
- Build the smallest payload that proves the idea.
- Run it again outside GDB.
- Explain what changed in registers and memory.
The core commands stay deliberately boring and repeatable:
file ./chall
checksec ./chall
readelf -a ./chall
objdump -d -M intel ./chall
nm -an ./chall
gdb ./chall
That repetition is useful. It turns initial reconnaissance into a habit instead of a checklist I have to remember under pressure.
Current series
| Part | Topic | Main lesson |
|---|---|---|
| 0 | Roadmap | Build a practical, repeatable learning loop |
| 1 | Stack frames | Read calls, registers, local variables, and saved return addresses |
| 2 | Basic ret2win | Overwrite saved RIP and reuse an existing function |
| 3 | ret2win with one argument | Set rdi with pop rdi; ret |
| 4 | ret2win with two arguments | Control rdi and rsi in one ROP chain |
| 5 | ret2win with three arguments | Apply the AMD64 calling convention to rdx |
| 6 | Cyclic offset discovery | Measure the saved RIP offset instead of guessing |
| 7 | Stack alignment | Diagnose movaps crashes and repair alignment |
| 8 | Compiler-generated SSE alignment | See the same failure in ordinary compiled C |
| 9 | My first ret2libc leak | Leak libc, calculate its base, and plan system("/bin/sh") |
The first eight labs are complete. Part 9 is my current checkpoint, so that post documents the model and the two-stage plan without pretending I have finished the learner exploit.
The longer path
The current labs cover the beginning of stack exploitation. The full roadmap continues through six broad phases:
- foundations: C memory, x86_64 assembly, ELF files, GDB, and pwntools;
- stack exploitation: overflows, ROP, ret2libc, leaks, and mitigation-aware payloads;
- format strings and linking internals;
- heap exploitation across relevant glibc versions;
- reversing unfamiliar and stripped binaries;
- advanced topics such as SROP, ret2dlresolve, fuzzing, and kernel basics.
My target is practical independence: find the bug, describe the primitive, choose an exploit direction, and debug failure without immediately reaching for a walkthrough.
The labs and full curriculum live in my PWN-path repository.