Reverse › Module 2 › Lesson 3
Stack and Heap
Stack frames and heap allocations explain local variables and dynamic data — map them on $RE_LAB toy binaries only.
Visual · re_stack_heap
Stack/heap literacy. $RE_LAB only. Original Cyberlium.
Opening
The stack grows down, the heap grows up — both show up in crackme password checks.
The stack stores return addresses, saved frame pointers, and local variables in LIFO order — each function call pushes a frame. The heap serves malloc/new allocations with longer lifetime. RE traces show password buffers on stack and flag strings sometimes on heap in CTF binaries on $RE_LAB. Cyberlium teaches memory layout literacy for following data flow. You will NOT use stack knowledge for unauthorized memory corruption on production. Next: CPU Lab.
1. Stack frames (named)
Function prologue pushes RBP and sets RSP; epilogue restores before RET. Local arrays sit below RBP — crackmes copy input into stack buffers then compare.
Draw stack diagram for YOUR toy check function on $RE_LAB: return address, saved RBP, locals, current RSP.
Command guide
Try these commands — Stack frames (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Stack vs heap — https://man7.org/linux/man-pages/man5/elf.5.html (memory layout literacy) objdump disassembly — https://sourceware.org/binutils/docs/binutils/objdump.html pwn.college — https://pwn.college/ (stack literacy in authorized labs)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install binutils sudo apt install build-essential
macOS: Built-in (Xcode CLI) or brew install binutils
Command — copy this
xcode-select --install # or brew install gcc
Windows: Use WSL binutils Use WSL or MinGW
═══ LINUX / macOS ═══
Optional command
sudo apt install build-essential binutils # gcc objdump
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
cat > "$LAB_RE/src/check.c" <<'EOF'
#include <stdio.h>
int add(int a, int b) { return a + b; }
int main(void) {
int x = 3, y = 5;
printf("sum=%d
", add(x, y));
return 0;
}
EOFCommand — copy this
gcc -Wall -O0 -g -o "$LAB_RE/bin/check" "$LAB_RE/src/check.c" objdump -d "$LAB_RE/bin/check" | grep -E '<add>|<main>|push|pop|sub.*rsp' | head -15
Primary tools to practice this lesson: objdump, gcc. Reference sites: Stack vs heap (https://man7.org/linux/man-pages/man5/elf.5.html); objdump disassembly (https://sourceware.org/binutils/docs/binutils/objdump.html); pwn.college (https://pwn.college/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Heap allocations
malloc returns a pointer in RAX; data lives until free. CTF flags sometimes hide behind heap structures — still only authorized binaries on $RE_LAB.
Use gdb x/ commands to examine stack vs heap addresses — stack near RSP, heap at higher addresses in typical Linux layouts.
3. Memory literacy boundaries
Forbidden: stack smashing neighbor services, heap spray on unauthorized apps, or 'just testing overflow' on commercial software.
Ship: one stack diagram + one sentence on heap vs stack for YOUR toy binary. Next: CPU Lab.
4. What you ship: stack/heap diagram for $RE_LAB
Stack frame diagram + heap note for YOUR toy binary. $RE_LAB named. NEVER unauthorized memory attacks. chmod 600.
5. What you record before the next lesson
Date. Stack/heap diagram. $RE_LAB named. File t23-m02-l03-stack-heap.txt chmod 600.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Overflow a production web server 'to learn stack.' Skip frame diagram.
Right
Draw stack/heap diagram for $RE_LAB toy binary. Next: CPU Lab.
Mission: diagram memory for YOUR toy binary
1) Draw one stack frame with return address and locals. 2) Note if any data uses heap in YOUR binary. 3) Write NEVER unauthorized overflow line. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Local password buffers usually live on the stack.
Knowledge Check
APPLY: Stack/heap literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Return addresses sit on the stack.
True or False
Knowledge Check
APPLY: malloc return value typically appears in:
Multiple choice