EXPLORE THE CURRICULUM
Your learning map
See how it fits together. Find the lesson you want to learn next.
37 lessons · C · Systems · Pwn
Reset filtersL1C & computer internalsStep 56–7015 lessons
- 056 Starting C — In the Language the Machine Knows DirectlyExplain the difference between an interpreted language (Python) and a compiled language (C)
- 057 C Control Flow and Functions — Same Thinking, Different NotationWrite C's if, for, and while by matching them to their Python counterparts
- 058 Pointers 1 — The Day You Hold Addresses in Your HandConfirm with %p output that every variable lives at an address in memory
- 059 Pointers 2: Arrays — The Law of Adjacent SlotsConfirm with address output that an array is "slots stuck together in memory"
- 060 Memory Layout — The Map of a Running ProgramExplain that a running program's memory is divided into four regions (code/data/heap/stack)
- 061 malloc and free — Borrow from the Heap and Return ItBorrow as much memory as you need mid-run with malloc, used together with sizeof
- 062 Experiment: Buffer Overflow — Where the Overflowing Input GoesExplain what a buffer is and why it overflows
- 063 The Compilation Process — Four Workers Passing the BatonRecite in order the four stages behind gcc hello.c -o hello (preprocessing, compilation, assembly, linking)
- 064 First Encounter with Assembly — The Final Form of My CodeExplain what assembly language is (the human-readable edition of machine code)
- 065 CPU and Registers — Seeing the Heartbeat of ExecutionExplain why the CPU computes in registers instead of memory
- 066 The Structure of an Executable — The Blueprint Inside the IconExplain that an executable consists of "a manual (header) + purpose-specific regions (sections)"
- 067 The Role of the Operating System — Every Request Goes to the KernelExplain what the kernel is and why programs can't touch hardware directly
- 068 The True Nature of a Process — The fork ExperimentExplain processes, PIDs, and PPIDs, and observe them with ps and pstree
- 069 Virtual Memory — Every Process's Sweet IllusionExplain the difference between virtual and physical addresses, and the role of the page table connecting them
- 070 Project — Building a Memory Observation Tool in CComplete the C program memmap, which draws a map of its own memory addresses
L3Assembly & system foundationsStep 182–1909 lessons
- 182 Assembly 1: Registers, mov/push/pop/call/ret, Stack Frames — The Alphabet of the Common LanguageKnow the names and roles of the x86-64 general-purpose registers (rax, rdi, rsp, rbp, etc.)
- 183 Assembly 2: gdb Basics — A Microscope for Running ProgramsExplain what gcc -g -O0 means (-g: debug info, -O0: optimization off) and build a debugging binary
- 184 Assembly 3: Following a C Program Line by Line in gdb — Live Coverage of the Calling ConventionRead assembly source made with gcc -S side by side with gdb's disas output
- 185 The Stack, Fully Understood — A Complete Map of What Piles Up on a Function CallDraw the order of what piles up on the stack on a function call (local variables → saved rbp → RET)
- 186 ★ Reproducing a Buffer Overflow: RET Overwrite Success — Your First Memory AttackCompile a target binary with lab-only options and explain what each option means
- 187 Protections: NX, ASLR, Canary, PIE — A Map of the Four-Layer DefenseExplain the working principle of each of the four protections — NX, Canary, ASLR, PIE — in one sentence
- 188 pwntools 101: Connections, p64, Payload Automation — From Hand Attacks to ScriptsInstall pwntools in a venv and verify the installation
- 189 ★ Mini Project: Completing an Overflow Exploit Script — Turning a Hand Attack into EngineeringExplain the principle of the cyclic() pattern (a sequence of non-repeating chunks)
- 190 Finding/Forming a Team + the CTFtime Calendar — Turning a Solo Game into a Team SportRead CTFtime's competition calendar, team pages, and ranking structure
L3Pwn & memoryStep 203–21412 lessons
- 203 Writing Shellcode: Hand-Crafting an execve Shellcode — The 29 Bytes That Spawn a ShellExplain the execve system call convention (rax=59, rdi, rsi, rdx)
- 204 ret2win: Calling the Function You Want — RET Overwrite That Even Hands Over the ArgumentExplain that in the System V calling convention, the first argument is passed via rdi
- 205 ROP 1: The Gadget Concept, ROPgadget/ropper — The Assembly Art of Code FragmentsKnow the definition of a gadget ("an instruction fragment ending in ret") and the kinds of useful gadgets
- 206 ROP 2: Calling system("/bin/sh") with a Chain — Past NX, Into a ShellExplain why ROP is the only road on an NX-enabled binary
- 207 ret2libc: Leaking the libc Address to Bypass ASLR — Tracing an Address That Changes Every RunProve with an ldd measurement how ASLR changes libc's address
- 208 Format String: Writing Memory with %n — An Attack That Writes Through a Print FunctionExplain why printf(buf) is vulnerable, in comparison with the correct code
- 209 Finishing pwnable.kr Toddler's Bottle — Graduation Day for the Beginner WargameSummarize the full Toddler's Bottle challenge list and the trap each one teaches
- 210 Understanding GOT/PLT and the GOT Overwrite — Hijacking Function CallsExplain the roles of the PLT (jump pads) and the GOT (address table), and the sequence of lazy binding
- 211 Heap Fundamentals: Allocator Behavior and the Use-After-Free Concept — Reusing Returned LandDraw the structure of a heap chunk (header + user data) and compute its size
- 212 A Taste of Heap Exploitation: tcache Poisoning — Overwriting the Queue's LedgerExplain that the tcache is a singly linked list, and where the next pointer lives
- 213 Three Easy pwnable.tw Challenges — Into a World Without SourceExplain the difficulty and structure differences between pwnable.kr and pwnable.tw
- 214 ★ Midterm Check: Independent Exploitation of a Canary+NX Binary — Leak It, Keep It Alive, Overwrite ItDesign the entire exploit process yourself, from protection identification (recon) to strategy