Exploit › Module 3 › Lesson 1
Stack Frame Named
Stack frames hold locals, saved frame pointer, and return metadata — read layout on $PWN_LAB toys to understand why corruption is dangerous.
Visual · pwn_stack_frame_named
Stack frame literacy. $PWN_LAB only. Original Cyberlium.
Opening
Every function call builds a stack frame — knowing its parts explains crash sites without crafting overwrites.
On entry, CALL pushes return address; the prologue often saves RBP and adjusts RSP for locals. Locals sit below the saved frame pointer; return address sits above the locals on typical x86-64 Linux frames. Overflowing a local can corrupt saved data — defenders see this in crash backtraces. Cyberlium teaches stack frame literacy for gdb backtrace reading on YOUR toy C at $PWN_LAB. You will NOT calculate overwrite offsets for weapon chains. Next: Heap Basics Named.
1. Frame components (named)
Return address: where RET jumps. Saved RBP: links to caller frame. Locals: fixed-size arrays and scalars on the stack. Argument spill area may appear per calling convention.
On $PWN_LAB, disassemble YOUR toy function and sketch frame diagram in notes — label components, not attack offsets.
Command guide
Try these commands — Frame components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Stack frame literacy — https://man7.org/linux/man-pages/man5/elf.5.html (process image layout) x86-64 ABI — https://refspecs.linuxfoundation.org/elf/x86_64-abi-0.99.pdf (stack/registers) LiveOverflow — https://www.youtube.com/c/LiveOverflow (stack visualization concepts)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install binutils sudo apt install build-essential
macOS: Built-in (Xcode CLI) or brew install binutils
Command — copy this
xcode-select --install # or brew install gcc
Windows: Use WSL binutils Use WSL or MinGW
═══ LINUX / macOS ═══
Optional command
sudo apt install binutils # objdump
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
objdump -d "$LAB_PWN/bin/bof_vuln" | grep -A20 '<main>:' | head -22
objdump -d "$LAB_PWN/bin/bof_vuln" | grep -E 'sub.*rsp|leave|ret|buf' | head -10
echo 'stack frame literacy: local buf[32] lives on stack — overflow corrupts adjacent data'Primary tools to practice this lesson: objdump, gcc. Reference sites: Stack frame literacy (https://man7.org/linux/man-pages/man5/elf.5.html); x86-64 ABI (https://refspecs.linuxfoundation.org/elf/x86_64-abi-0.99.pdf); LiveOverflow (https://www.youtube.com/c/LiveOverflow). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Reading frames in gdb
backtrace shows call chain; frame command prints saved RBP and return address; info locals lists stack variables. Compare diagram to source line of overflow toy.
Segfault at RET or stack smashing detected messages tie symptoms to frame corruption class.
3. Literacy supports triage — not weapon math
Forbidden: offset calculators for return overwrite, rop gadget hunting on production binaries. Allowed: explain why overflowing char buf[32] threatens adjacent frame data on YOUR toy.
Ship: stack frame diagram for one $PWN_LAB function with four labeled regions. Next: Heap Basics Named.
4. What you ship: stack frame diagram for $PWN_LAB
One function frame diagram: return addr, saved RBP, locals, args note. Toy sha256. NO offset recipes. chmod 600.
5. What you record before the next lesson
Date. Stack frame diagram. $PWN_LAB named. File t24-m03-l01-stack-frame-named.txt chmod 600.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Calculate exact bytes to hijack RET on production. Skip diagram and jump to shellcode.
Right
Draw stack frame diagram from YOUR toy disassembly. Next: Heap Basics Named.
Mission: diagram one stack frame
1) Sketch frame for one toy function. 2) Label return address and locals. 3) Note one gdb command used. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Frame literacy makes CVE stack descriptions readable.
Knowledge Check
APPLY: Stack frame literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: Return address lives on the stack frame.
True or False
Knowledge Check
APPLY: Overflowing a local buffer can corrupt:
Multiple choice