- Published on
My current pwn milestone: understand the two-stage ret2libc flow from a puts leak to a calculated system("/bin/sh") call.
Pwn-learning-path
All Posts
- pwn (12)
- ctf (11)
- pcc25-qual (10)
pwn-learning-path (10)
- rop (8)
- ret2win (5)
- reverse-engineering (4)
- tutorial (3)
- xor (3)
- binary-exploitation (3)
- buffer-overflow (3)
- gdb (3)
- calling-convention (3)
- cryptography (2)
- misc (2)
- binary-analysis (2)
- pwntools (2)
- stack-alignment (2)
- cpp (1)
- programming (1)
- coding (1)
- software-development (1)
- docker (1)
- cybersecurity (1)
- capture-the-flag (1)
- blogging (1)
- getting-started (1)
- vm (1)
- custom-architecture (1)
- forensics (1)
- bash-history (1)
- bash (1)
- parameter-expansion (1)
- wildcards (1)
- python (1)
- injection (1)
- exec (1)
- code-injection (1)
- memory-corruption (1)
- java (1)
- spring-boot (1)
- classfinal (1)
- aes (1)
- static-analysis (1)
- web (1)
- lfi (1)
- php (1)
- filter-chains (1)
- roadmap (1)
- x86-64 (1)
- stack (1)
- sse (1)
- ret2libc (1)
- got-plt (1)
- Published on
Reproducing the ROP alignment problem with normal C SSE intrinsics and inspecting the MOVAPS instruction generated by GCC.- Published on
The payload reached win but still crashed: diagnosing MOVAPS, understanding 16-byte alignment, and fixing the chain with one RET.- Published on
Why I stopped guessing buffer-overflow offsets, how to inspect RSP when RET crashes, and how a cyclic pattern revealed offset 93.- Published on
Adding RDX to the chain completed my first three-register ROP setup and reinforced how the AMD64 calling convention shapes payloads.