Class 02 · KP 01 / 23

Why Memory Layout Matters

Linux x86-64 process address space: the stack grows down, the heap grows up.

Memory-corruption exploits are about where bytes live and what the CPU does with them.
To hijack a program you must know the geography of its address space: where code sits, where user data sits, and where control data (return addresses) sits.
Today: the virtual address space, the CPU registers, the stack, the calling convention, and the tools to inspect all three.

Key Takeaway

Exploitation = making the CPU execute your choice of code by corrupting data the CPU trusts.