Stack Frame Named

Stack frames hold locals, saved frame pointer, and return metadata — read layout on $PWN_LAB toys to understand why corruption is dangerous.

Stack Frame Named• Audio Walkthrough

00:00/03:29

Visual · pwn_stack_frame_named

Stack frame literacy. $PWN_LAB only. Original Cyberlium.

Every function call builds a stack frame — knowing its parts explains crash sites without crafting overwrites.

On entry, CALL pushes return address; the prologue often saves RBP and adjusts RSP for locals. Locals sit below the saved frame pointer; return address sits above the locals on typical x86-64 Linux frames. Overflowing a local can corrupt saved data — defenders see this in crash backtraces. Cyberlium teaches stack frame literacy for gdb backtrace reading on YOUR toy C at $PWN_LAB. You will NOT calculate overwrite offsets for weapon chains. Next: Heap Basics Named.

1. Frame components (named)

Return address: where RET jumps. Saved RBP: links to caller frame. Locals: fixed-size arrays and scalars on the stack. Argument spill area may appear per calling convention.

On $PWN_LAB, disassemble YOUR toy function and sketch frame diagram in notes — label components, not attack offsets.

Command guide

Try these commands — Frame components (named)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Stack frame literacy — https://man7.org/linux/man-pages/man5/elf.5.html (process image layout) x86-64 ABI — https://refspecs.linuxfoundation.org/elf/x86_64-abi-0.99.pdf (stack/registers) LiveOverflow — https://www.youtube.com/c/LiveOverflow (stack visualization concepts)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install binutils
sudo apt install build-essential

macOS: Built-in (Xcode CLI) or brew install binutils

Command — copy this

xcode-select --install  # or brew install gcc

Windows: Use WSL binutils Use WSL or MinGW

═══ LINUX / macOS ═══

Optional command

sudo apt install binutils  # objdump

Command — copy this

export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
objdump -d "$LAB_PWN/bin/bof_vuln" | grep -A20 '<main>:' | head -22
objdump -d "$LAB_PWN/bin/bof_vuln" | grep -E 'sub.*rsp|leave|ret|buf' | head -10
echo 'stack frame literacy: local buf[32] lives on stack — overflow corrupts adjacent data'

Primary tools to practice this lesson: objdump, gcc. Reference sites: Stack frame literacy (https://man7.org/linux/man-pages/man5/elf.5.html); x86-64 ABI (https://refspecs.linuxfoundation.org/elf/x86_64-abi-0.99.pdf); LiveOverflow (https://www.youtube.com/c/LiveOverflow). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Reading frames in gdb

backtrace shows call chain; frame command prints saved RBP and return address; info locals lists stack variables. Compare diagram to source line of overflow toy.

Segfault at RET or stack smashing detected messages tie symptoms to frame corruption class.

3. Literacy supports triage — not weapon math

Forbidden: offset calculators for return overwrite, rop gadget hunting on production binaries. Allowed: explain why overflowing char buf[32] threatens adjacent frame data on YOUR toy.

Ship: stack frame diagram for one $PWN_LAB function with four labeled regions. Next: Heap Basics Named.

4. What you ship: stack frame diagram for $PWN_LAB

One function frame diagram: return addr, saved RBP, locals, args note. Toy sha256. NO offset recipes. chmod 600.

5. What you record before the next lesson

Date. Stack frame diagram. $PWN_LAB named. File t24-m03-l01-stack-frame-named.txt chmod 600.

6. Wrong vs right: weaponized exploits vs memory-safety literacy

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Calculate exact bytes to hijack RET on production. Skip diagram and jump to shellcode.
Right: Draw stack frame diagram from YOUR toy disassembly. Next: Heap Basics Named.

Hands-on Exercise