Summary
- Buffer overflow = unbounded write past a fixed buffer into adjacent memory.
- Stack order low-to-high:
buf→ saved RBP → saved return address. - Overwriting the saved return address hijacks control flow at
ret. - ret2win:
padding + address-of-existing-function; find padding via cyclic patterns. - 64-bit needs valid canonical pointers and 16-byte stack alignment (
retgadget). - Prevent with bounded copies (
fgets,snprintf) plus canaries, ASLR, NX.