- Published on
Why I stopped guessing buffer-overflow offsets, how to inspect RSP when RET crashes, and how a cyclic pattern revealed offset 93.
Pwntools
All Posts
- pwn (12)
- ctf (11)
- pcc25-qual (10)
- pwn-learning-path (10)
- rop (8)
- ret2win (5)
- reverse-engineering (4)
- tutorial (3)
- xor (3)
- binary-exploitation (3)
- buffer-overflow (3)
- gdb (3)
- calling-convention (3)
- cryptography (2)
- misc (2)
- binary-analysis (2)
pwntools (2)
- stack-alignment (2)
- cpp (1)
- programming (1)
- coding (1)
- software-development (1)
- docker (1)
- cybersecurity (1)
- capture-the-flag (1)
- blogging (1)
- getting-started (1)
- vm (1)
- custom-architecture (1)
- forensics (1)
- bash-history (1)
- bash (1)
- parameter-expansion (1)
- wildcards (1)
- python (1)
- injection (1)
- exec (1)
- code-injection (1)
- memory-corruption (1)
- java (1)
- spring-boot (1)
- classfinal (1)
- aes (1)
- static-analysis (1)
- web (1)
- lfi (1)
- php (1)
- filter-chains (1)
- roadmap (1)
- x86-64 (1)
- stack (1)
- sse (1)
- ret2libc (1)
- got-plt (1)
- Published on
A 64-byte buffer, an oversized read, and 72 bytes to saved RIP: how my first ret2win payload redirected control flow.