Skip to content
BinaryExploitation

Memory safety, from the defender's side

Understand the bug.Ship the mitigation.

A structured reference to memory-corruption vulnerabilities in C and C++: how stack and heap overflows, use-after-free and integer bugs happen, and how compilers, sanitizers, fuzzers and safer languages stop them.

Explore the mapRead the guides
areas
7
in-depth guides
11
glossary terms
15

Memory map

Seven areas, one bug lifecycle

Start with how memory is laid out, learn the classes of bugs that corrupt it, then the layers that prevent, detect, contain and triage them.

0x0000

Memory Fundamentals

Stack, heap, ELF segments and calling conventions: the terrain every bug lives on.

1 guide
0x1000

Vulnerability Classes

Overflows, use-after-free, double free, integer and format-string bugs, and how to spot them.

3 guides
0x2000

Exploit Mitigations

Canaries, NX/DEP, ASLR/PIE, RELRO, FORTIFY_SOURCE, CFI, CET and PAC, and how to verify them.

2 guides
0x3000

Finding Bugs

AddressSanitizer, UBSan and coverage-guided fuzzing with libFuzzer and AFL++.

2 guides
0x4000

Crash Triage

Read signals, backtraces, sanitizer reports and core dumps, and decide what to fix first.

1 guide
0x5000

Secure Coding

Memory-safe languages, safer C++ and a realistic migration strategy.

1 guide
0x6000

Learning Path

A staged, legal path from C and assembly to CTF pwn challenges and security careers.

1 guide

Defense in depth

No single control is enough

Every mitigation has gaps. Real resilience comes from stacking layers so a bug that slips past one is caught or contained by the next.

  1. Prevent

    Memory-safe languages, bounds-checked APIs, compiler warnings and code review stop bugs from being written.

    • Rust
    • std::span
    • -Wformat=2
    • ckd_add

  2. Detect

    ASan, UBSan and coverage-guided fuzzing surface the bugs that were written, before an attacker does.

    • ASan
    • UBSan
    • libFuzzer
    • AFL++

  3. Mitigate

    Canaries, NX, ASLR/PIE, RELRO, CFI and shadow stacks make the remaining bugs hard to exploit.

    • canary
    • NX
    • PIE
    • RELRO
    • CET

  4. Respond

    Crash triage, core dumps and deduplication turn field crashes into prioritised fixes.

    • gdb
    • coredumpctl
    • !analyze

Latest guides

Read the deep dives

All guides
0x6000 · Learning Path

A Binary Exploitation Learning Path Through CTFs

A staged, legal path from C and assembly to CTF pwn challenges: what to learn in which order, practice platforms built for it, lab rules, and how it leads to defensive careers.

0x3000 · Finding Bugs

Coverage-Guided Fuzzing with libFuzzer and AFL++

Write a fuzz harness, build it with sanitizers, run libFuzzer and AFL++, manage corpora and dictionaries, and run continuous fuzzing in CI with OSS-Fuzz or ClusterFuzzLite.

Glossary

Speak the language

Short, precise definitions of the terms you will meet in advisories, crash reports and compiler docs.

Open the glossary

Editorial line

Defensive by design

Understanding exploitation is what makes mitigations make sense. We teach the mechanics at the level a secure coder, reviewer or incident responder needs, and stop short of weaponisation.

What you will find

  • Vulnerable patterns next to their fixes
  • Compiler, linker and sanitizer flags you can ship
  • How to verify mitigations with checksec and readelf
  • How to read crash and sanitizer reports

What we never publish

  • Working exploit chains or shellcode
  • Step-by-step bypasses of mitigations
  • Payloads aimed at real software
  • Solutions to live CTF challenges