- 1byte overwrtie in RA & libc_start_main gadget
Dec 31, 2025 · Pwnable, Introduction
- what is cr4 register pinning
Dec 28, 2025 · Pwnable, Kernel
- what is FG-KASLR
Dec 28, 2025 · NOT YET
- cache——
Dec 28, 2025
- what is slab ( in-deepth )
Dec 28, 2025 · Pwnable, Kernel
- how to kernel ctf start ( basic setting )
Dec 27, 2025 · Pwnable, How2pwn, Kernel
- pushrbp brush in RTM
Dec 26, 2025 · Pwnable, Introduction
- what is pipe
Dec 23, 2025
- kernel initramfs flow
Dec 18, 2025
- kernel mitigation shortcut
Dec 17, 2025 · Kernel, Introduction
- what is cred structure
Dec 17, 2025 · Kernel
- what is kernel file stuct
Dec 17, 2025 · Kernel, Introduction, NOT YET
- what is kernel file private_data
Dec 17, 2025 · Kernel
- what is heap spray
Dec 17, 2025 · Kernel
- GFP_KERNEL vs GFP_KERNEL_ACCOUNT
Dec 17, 2025 · Pwnable, Kernel
- what is KASLR
Dec 17, 2025 · Pwnable, Kernel
- how kernel start
Dec 14, 2025 · Introduction, Kernel
- what is initramfs & buzybox
Dec 14, 2025
- kernel stack & user stack
Dec 6, 2025
- user & kernel address deep analyze
Dec 6, 2025 · Introduction, Kernel
- what is slab
Dec 6, 2025 · Introduction, Kernel
- kernel vmalloc vs kmalloc
Dec 6, 2025 · Introduction, Kernel
- kernel module’s text,data,bss location
Dec 6, 2025
- what is direct map
Dec 6, 2025 · Introduction, Kernel, Architecture
- how to check secure linux kernel
Dec 5, 2025
- what is pahole
Dec 5, 2025
- nc screen cutting troubleshooting
Dec 4, 2025 · Troubleshooting, Pwnable
- ret2usr template
Dec 2, 2025 · Pwnable, Introduction, Kernel
- what is cred
Dec 2, 2025
- what is kernel ring
Dec 2, 2025
- task_struct analyze short cut
Dec 2, 2025 · NOT YET
- user & kernel address
Dec 2, 2025 · Introduction, Kernel
- x86-64 register shortcut
Dec 2, 2025 · Introduction, Architecture, Shortcut
- what is CR3 register
Dec 2, 2025 · Introduction, Kernel, Architecture
- what is ret2usr
Dec 2, 2025 · Pwnable, Kernel, How2pwn
- file operation function table & table overwrite
Dec 2, 2025 · Introduction, Kernel, How2pwn
- what is SMEP & SMAP
Dec 2, 2025 · NOT YET
- see cmdline when kernel ctf
Dec 2, 2025 · Pwnable, Kernel
- how to make infinity loop by stack_chk_fail
Nov 26, 2025 · Pwnable, Introduction
- data overwrite by setbuf
Nov 26, 2025 · Pwnable, Introduction
- gdb do not work when kernel ctf
Nov 26, 2025 · Troubleshooting, Pwnable, Kernel
- how to use stdout & stdin & stderr to gadget by stack pivoting
Nov 23, 2025 · Pwnable, Introduction
- fflush() can arbitrary readable by FSOP
Nov 23, 2025 · Glibc, Pwnable, Introduction
- what is ret2dlresolve
Nov 23, 2025 · NOT YET
- bruteforce oneshot when bof
Nov 23, 2025 · Pwnable, Introduction
- call gadget in __libc_csu_init
Nov 23, 2025 · Pwnable, Introduction
- what is c#
Nov 23, 2025 · Reversing
- double pointer calc
Nov 23, 2025 · Reversing, Introduction, Troubleshooting
- re-resolve in got
Nov 22, 2025 · Pwnable, Introduction
- what is stack pivoting
Nov 22, 2025 · Introduction, Pwnable
- when heap overflow
Nov 21, 2025 · Pwnable, Introduction
- stack garbage leak
Nov 20, 2025 · Pwnable, Stack
- what is heap overlapping
Nov 20, 2025 · Pwnable, Introduction, Heap
- when patch binary
Nov 19, 2025 · Pwnable, Introduction
- how to leak shortcut
Nov 19, 2025 · Pwnable, Shortcut, How2pwn
- when overwrite mastercanary padding
Nov 14, 2025 · Pwnable, Troubleshooting
- rbp rsp poisioning
Nov 14, 2025 · Pwnable, Introduction, How2pwn
- send() vulnerability in socket communication
Nov 13, 2025 · Pwnable, Introduction, Troubleshooting
- how read() work
Nov 12, 2025
- how ld , libc load to memory & how ASLR work - ld,libc
Nov 11, 2025 · Introduction, Glibc, Kernel
- how program start - kernel
Nov 7, 2025
- what is TLS
Nov 6, 2025
- what is TCB
Nov 6, 2025
- what is fs_base
Nov 6, 2025
- how main binary load to memory & how ASLR work - main binary & how PIE work
Nov 6, 2025 · Kernel, Introduction
- how heap load to memory & what is brk & how ASLR work - heap
Nov 6, 2025 · Heap, Pwnable, Introduction
- Linux x86-64 Process virtual memory layout shortcut
Nov 6, 2025 · Shortcut, Pwnable, Glibc
- top chunk consolidation
Nov 5, 2025 · Pwnable, Glibc, Heap
- what is unsorted bin , small bin, large bin → bin ) (deep analyze ) & libc leak
Nov 5, 2025 · Heap, Glibc, Pwnable
- how to change control flow shortcut
Nov 5, 2025 · Pwnable, Introduction, Shortcut
- calloc does not use tcache in ≤2.40
Nov 2, 2025 · Pwnable, Troubleshooting
- what is safe-linking in heap & bypss
Nov 2, 2025 · Pwnable, Heap, Glibc
- fastbin poisioning & dup
Nov 2, 2025 · Pwnable, Heap
- what is tcache key ( tcache dup mitigation ) & bypass
Nov 2, 2025 · Pwnable, Introduction, Heap
- heap Enhanced Security ( each glibc version )
Nov 1, 2025 · Introduction, Pwnable, Heap
- how to watch source code in pwngdb 2 ( deep analyze )
Oct 31, 2025 · Pwnable, Introduction, Troubleshooting
- what is house of apple
Oct 31, 2025 · How2pwn, Pwnable, Introduction
- how to pwn (life hack) shortcut
Oct 29, 2025 · Shortcut, Pwnable, How2pwn
- x86-64 8byte aligned
Oct 29, 2025 · Architecture, Pwnable, Troubleshooting
- _IO_SYSWRITE , _IO_SYSREAD , _IO_overflow , _IO_underflow , _IO_flush diff
Oct 29, 2025 · Glibc, Pwnable
- docker glibc version not support at visual studio code server
Oct 28, 2025 · Troubleshooting
- shellcode shortcut
Oct 24, 2025 · Shortcut
- x86-64 register Immediate operand
Oct 24, 2025 · Architecture
- one_gadget level
Oct 21, 2025 · Pwnable
- gadget diversity
Oct 21, 2025 · Pwnable, Introduction, How2pwn
- libc version troubleshooting 2
Oct 20, 2025 · Troubleshooting
- glibc analyize
Oct 20, 2025 · Glibc, Introduction, Shortcut
- what is glibc Relocation section
Oct 20, 2025 · Glibc, Introduction
- glibc got overwrite
Oct 20, 2025 · Introduction, How2pwn, Bypass
- one_gadget requirement fulfill - glibc got overwrite
Oct 20, 2025 · Glibc
- what is glibc IFUNC
Oct 18, 2025 · Glibc, Introduction
- set debuginfod enabled on
Oct 18, 2025 · Introduction
- bof by null
Sep 27, 2025 · Pwnable, Introduction
- how canonical(ICANON) mode work
Sep 27, 2025
- 2’s complement
Sep 25, 2025 · Introduction
- what is prctl
Sep 25, 2025 · Introduction
- when can byte patch ( ___stack_chk_fail method )
Sep 25, 2025 · Pwnable
- setuid setgid program env
Sep 24, 2025 · Troubleshooting
- when stack boom!!
Sep 24, 2025 · Troubleshooting
- fsb clear
Sep 23, 2025 · Pwnable
- when socket connection or intend reverse shell in dreamhack problem
Sep 23, 2025 · Pwnable
- io & file fuction shortcut
Sep 23, 2025 · Shortcut, Introduction, Pwnable
- fd is tty socket file in kernel
Sep 23, 2025 · Introduction, Pwnable, Kernel
- scanf loop error
Sep 16, 2025 · Troubleshooting
- scanf() inner buffer vs read() inner buffe
Sep 16, 2025 · Introduction, Pwnable
- what is file inner buffer
Sep 16, 2025 · Introduction, Pwnable
- what is setvbuf & setbuf
Sep 15, 2025 · Introduction
- how PIE work
Sep 14, 2025 · NOT YET, Kernel, Introduction
- pwntools recv recvline pitfall
Sep 14, 2025 · Pwnable, Troubleshooting
- c++ reclass method
Sep 6, 2025 · NOT YET
- what is dmidecode
Sep 5, 2025 · Introduction
- how to create c++ virtual function table (vptr)
Sep 1, 2025 · C++, Introduction
- how to know PIE & stack canary without using checsec
Aug 22, 2025 · Introduction
- what is capability leak ( in fd perspective )
Aug 22, 2025 · Introduction, Pwnable
- how system work
Aug 22, 2025 · Pwnable, Introduction
- system drop privilege when setuid
Aug 22, 2025 · Pwnable
- when libc leak pwnable process
Aug 21, 2025 · Pwnable, Introduction, How2pwn
- how to breakout chroot with root privilege 2 ( In-depth analysis )
Aug 21, 2025 · Pwnable, Bypass
- what is house of force
Aug 20, 2025 · Pwnable, Introduction, Glibc
- what is house of spirit
Aug 20, 2025 · Glibc, Pwnable, Introduction
- what is dup2
Aug 20, 2025 · Pwnable, Introduction
- what is warnx
Aug 20, 2025 · Introduction, Pwnable
- what is lvalue & rvalue
Aug 19, 2025 · Introduction
- C language 2d array ptr vs integer
Aug 18, 2025 · Introduction
- what is __libc_start_main_ret
Aug 17, 2025 · Introduction
- python byte vs bytearray
Aug 16, 2025 · python
- what is ptrace
Aug 16, 2025 · Introduction
- what is mprotect
Aug 16, 2025 · Introduction
- Angr in funtion in the middle and additional restriction
Aug 16, 2025 · Angr
- gdbserver
Aug 14, 2025 · Introduction, Development
- read() pwntools vs tty
Aug 14, 2025 · Pwnable, Introduction
- Angr in function in the middle
Aug 13, 2025 · Angr
- armel vs armhf
Aug 12, 2025 · Pwnable, Introduction
- Arm32 execute & debugging env
Aug 12, 2025 · Introduction, Troubleshooting
- what is FSB 2 ( In-depth analysis )
Aug 9, 2025 · Stack, Pwnable, Introduction
- what is va_start in printf
Aug 9, 2025 · Pwnable, Glibc
- how ASLR work - stack
Aug 8, 2025 · Introduction, Kernel
- how to know os version by docker hash
Aug 8, 2025 · Introduction
- how malloc work
Aug 7, 2025 · Introduction, Glibc
- SIGSEGV vs -EFAULT
Aug 5, 2025 · Pwnable, Introduction
- FSOP shortcut
Aug 4, 2025 · Shortcut
- how to watch source code in pwngdb
Aug 4, 2025 · Introduction
- what is _IO_FILE_complete
Aug 4, 2025 · Pwnable, Introduction
- what is IO_validate_vtable & _IO_vtable_check & _IO_*_jumps
Aug 4, 2025 · Glibc, Pwnable
- how to bypass IO_validate_vtable by _IO_str_overflow
Aug 4, 2025 · Pwnable, Glibc, Vulnerability
- how to Arbitrary read in fwrite by FSOP
Aug 4, 2025 · Vulnerability, Pwnable, Glibc
- what is _IO_acquire_lock in FSOP
Aug 4, 2025 · Glibc, Pwnable
- glibc struct offset shortcut
Jul 31, 2025 · Shortcut, Pwnable, Reversing
- how to know glibc file version
Jul 31, 2025 · Introduction
- what is .hash in glibc
Jul 31, 2025 · NOT YET
- when leak stdin & stdout
Jul 30, 2025 · Troubleshooting
- tmux pwnlib terminal input bug
Jul 29, 2025 · Troubleshooting
- glibc with vtable
Jul 29, 2025 · Glibc
- what is _IO_buf_base & vulnerability
Jul 29, 2025 · Vulnerability, Glibc, Pwnable
- glibc with file function
Jul 29, 2025 · Glibc
- what is delim
Jul 29, 2025 · NOT YET
- c++ vector
Jul 29, 2025 · C++
- what is c++ shared_ptr
Jul 29, 2025 · C++, Introduction
- seccomp argument restriction
Jul 28, 2025 · Introduction, Pwnable
- how to breakout chroot with root privilege
Jul 27, 2025 · Introduction
- IO file buffer leak
Jul 27, 2025 · Pwnable, Introduction, Heap
- maybe_script_execute
Jul 25, 2025 · NOT YET
- arm64 architecture instruction
Jul 25, 2025 · Introduction
- CS_ARCH_ARM64' is not defined. Did you mean: ' CS_ARCH_ARM'
Jul 25, 2025 · Troubleshooting
- when stack aligned stuckin
Jul 25, 2025 · Troubleshooting
- libc upgrade when docker-set.sh
Jul 23, 2025 · Troubleshooting
- what is UTF & ASCII
Jul 22, 2025 · Introduction
- how got filling in runtime
Jul 11, 2025 · Introduction
- what is different between .got & .got.plt
Jul 11, 2025 · Introduction
- what is ASLR & PIE 2
Jul 10, 2025 · Introduction
- how program start
Jul 10, 2025 · Introduction, Glibc, NOT YET
- how program end
Jul 10, 2025 · Introduction, Glibc, NOT YET
- introduction of ELF sections
Jul 10, 2025 · Reversing, Introduction
- what is IFS environment & linux command process
Jul 9, 2025 · Introduction
- not only /bin/sh but sh
Jul 9, 2025 · Troubleshooting
- what is debugging symbols & common symbols
Jul 9, 2025 · Troubleshooting
- objdump & readelf shortcut
Jul 9, 2025 · Shortcut, Introduction
- how sizeof function work
Jul 8, 2025 · Introduction
- shellscript & shell blacklist shortcut
Jul 8, 2025 · Introduction, Shortcut
- what is _IO_FILE & _IO_FILE_plus
Jul 7, 2025 · Introduction, Glibc
- what is iofile_vtable 2
Jul 7, 2025 · Glibc, Introduction
- what is _IO_FILE Arbitrary Address Write
Jul 7, 2025 · Pwnable, Vulnerability, Introduction
- how to get glibc debugging sysmbols
Jul 6, 2025 · Introduction, Troubleshooting, Pwnable
- __run_exit_handlers free hook overwrite
Jul 6, 2025 · Introduction, Pwnable, Glibc
- seccomp shortcut
Jul 6, 2025 · Introduction, Shortcut
- libc inner plt & got and exploit
Jul 5, 2025 · Reversing, Network, Glibc
- tcachebins & arena free chunk and libc leak
Jul 3, 2025 · Heap, Pwnable
- shortcut when got overwrite & /bin/sh
Jul 2, 2025 · Shortcut, Pwnable
- analyze about ldd result
Jul 2, 2025 · Introduction
- LD_LIBRARY_PATH && LD_PRELOAD
Jul 2, 2025 · Introduction
- how to use patchelf
Jun 29, 2025 · Troubleshooting, Pwnable
- tmux shortcut
Jun 29, 2025 · Troubleshooting, Shortcut
- what is double free and how it work
Jun 28, 2025 · Heap, Introduction, Pwnable
- gdb ascii error
Jun 28, 2025 · Troubleshooting
- how to bypass SIGALRM signal in gdb
Jun 27, 2025 · Pwnable, Troubleshooting, Introduction
- how to change program libc
Jun 27, 2025 · Pwnable, Introduction
- what is tcache chunk
Jun 5, 2025 · Pwnable, Heap, Introduction
- what is master canary & fs_base
Apr 2, 2025 · Introduction, Pwnable, Troubleshooting
- analyze vmmap
Apr 2, 2025 · Introduction
- master canary leak & overwrite
Apr 2, 2025 · Pwnable, Introduction
- how to bypass canary by leaking with OOB
Apr 1, 2025 · Bypass, Introduction, Stack
- what is vdso & vsyscall
Apr 1, 2025 · Introduction
- libc_base & ld_base lower 12 bits
Apr 1, 2025 · Troubleshooting, Introduction
- what is _rtld_global & process exit()
Apr 1, 2025 · Pwnable, Introduction, Vulnerability
- EOF in docker env troubleshooting
Mar 31, 2025 · Troubleshooting, Pwnable
- how to find ROP gadget
Mar 31, 2025 · Introduction, Pwnable
- exploit in local & EOF in remote
Mar 31, 2025 · Troubleshooting, Pwnable
- \x90 slide when shellcode
Mar 31, 2025 · Pwnable, Introduction
- x86 call convention & how to ROP in x86
Mar 30, 2025 · Introduction, Stack
- ROP gadget shortcut
Mar 30, 2025 · Shortcut, Pwnable
- one_gadget. constraints analyze & troubleshooting
Mar 30, 2025 · Introduction, Troubleshooting, Pwnable
- what is SFP & FPO
Mar 29, 2025 · Pwnable, Introduction, Stack
- strcpy function null byte vulnerability
Mar 29, 2025 · Pwnable, Introduction, Vulnerability
- what is white space in shellcode & bypass
Mar 28, 2025 · Pwnable, Introduction, Bypass
- how to patch binary with ida
Mar 28, 2025 · Reversing, Introduction
- how to control stripped binary & __libc_start_main
Mar 27, 2025 · Introduction, Pwnable, Reversing
- Angr with Scanf control
Mar 24, 2025 · Angr, Pwnable, Troubleshooting
- how to debugging Arm binary
Mar 22, 2025 · Introduction, Troubleshooting
- Arm register usage
Mar 22, 2025 · Troubleshooting, Pwnable
- what is mprotect & bypass
Mar 22, 2025 · Troubleshooting, Bypass, Pwnable
- how to execute Arm binary
Mar 21, 2025 · Introduction, Pwnable
- Arm function prologue & epilogue
Mar 21, 2025 · Introduction
- gcc macro & std vulnerability
Mar 20, 2025 · Pwnable, Introduction
- what is _environ
Mar 19, 2025 · Introduction, Pwnable
- _environ troubleshooting
Mar 19, 2025 · Pwnable, Troubleshooting
- Pwntools shortcut
Mar 19, 2025 · Pwnable, Shortcut
- C++ const char
Mar 17, 2025 · C++, Troubleshooting
- what is FSB
Mar 17, 2025 · FSB, Pwnable, Introduction
- Mac shortcut
Mar 17, 2025 · Introduction, Shortcut
- linux shortcut
Mar 17, 2025 · Shortcut, Introduction
- what is ASLR & PIE
Mar 17, 2025 · Pwnable, Stack, Introduction
- how to bypass PIE with stack information
Mar 17, 2025 · Pwnable, Introduction, Bypass
- how to write FSB exlpoit code
Mar 17, 2025 · Pwnable, Introduction
- GDB shortcut
Mar 17, 2025 · Introduction, Shortcut
- what is __free_hook
Mar 12, 2025 · Pwnable, Introduction
- what is iofile_vtable
Mar 12, 2025 · Pwnable, Introduction
- what is Heap & how it work
Feb 28, 2025 · Pwnable, Introduction, Heap
- stack align troubleshooting
Feb 28, 2025 · Pwnable, Stack, Troubleshooting
- what is file descriptor
Feb 28, 2025 · Introduction
- IDA shortcut
Feb 28, 2025 · Introduction, Shortcut
- what is angr & code analyze
Jan 9, 2025 · Reversing, Angr, Introduction
- what is CGI( Common Gateway Interface )
Jan 9, 2025 · Web, Introduction
- cookie vs session
Jan 6, 2025 · Dreamhack, Web
- what is seccomp & bypass
Jan 6, 2025 · Dreamhack, Pwnable, Introduction
- what is netcat
Jan 5, 2025 · Dreamhack, pwn, Pwnable
- what is Imagebase
Jan 5, 2025 · Dreamhack, Reversing, Introduction