Summary

• Process memory is regioned: code (r-x), data (rw-), heap up, stack down.
• x86-64 args: RDI, RSI, RDX, RCX, R8, R9; return in RAX; RIP is the prize.
• A stack frame stores locals, saved RBP, and the saved return address.
• call saves the return address; ret blindly trusts it — overwrite it to hijack control.
• Addresses are little-endian; p64/p32 encode them.
• Tools: GDB + pwndbg/GEF, checksec, /proc/<pid>/maps, readelf.