https://algoatson.github.io/ A remote service with a stack overflow, that forks per connection, and that you have no binary for. Blind ROP turns the only feedback you have — does the connection crash or not — into an oracle, and reads the canary, finds gadgets, and dumps the binary over the socket. The most elegant trick in the ROP toolkit. en Tue, 16 Jun 2026 02:47:53 +0000 https://algoatson.github.io/p/house-of-apple-2/ https://algoatson.github.io/p/house-of-apple-2/ Mon, 15 Jun 2026 00:00:00 +0000 heappwnglibcfsop glibc 2.34 deleted __free_hook and __malloc_hook, and everyone's muscle memory broke. The modern answer is to forge a FILE — but the vtable is validated now. House of Apple 2 slips past that check by abusing a legitimate vtable that dereferences a second, unchecked one. https://algoatson.github.io/p/house-of-spirit/ https://algoatson.github.io/p/house-of-spirit/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 7 — instead of corrupting a real chunk, you forge a fake one in memory you already control and trick free() into filing it away. The next malloc hands it right back, so you get malloc to return the stack. https://algoatson.github.io/p/poison-null-byte/ https://algoatson.github.io/p/poison-null-byte/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 8 — the most innocent-looking heap bug there is: one null byte written one byte too far. It lands on a neighbouring chunk's size field, desyncs the allocator's bookkeeping, and ends with two chunks overlapping the same memory. https://algoatson.github.io/p/tcache-dup/ https://algoatson.github.io/p/tcache-dup/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 10 — the fastbin dup's lazier cousin. The tcache had no double-free check at all for two glibc releases, and the one it finally got is a single field you can overwrite. Free a chunk twice, get it twice, poison. https://algoatson.github.io/p/the-house-of-corrosion/ https://algoatson.github.io/p/the-house-of-corrosion/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 14, the finale — for the challenge that gives you no libc leak and barely any allocations. Blow open global_max_fast and the fastbin index arithmetic starts pointing into libc itself, turning "free a chunk of size N" into "write a heap pointer to a libc address". Bootstrap a leak from nothing. https://algoatson.github.io/p/the-house-of-einherjar/ https://algoatson.github.io/p/the-house-of-einherjar/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 11 — one null byte clears a chunk's PREV_INUSE, a forged prev_size says "the previous chunk starts way over there", and free() consolidates backward into a fake chunk you placed anywhere. Arbitrary allocation from a single off-by-one. https://algoatson.github.io/p/the-house-of-lore/ https://algoatson.github.io/p/the-house-of-lore/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 12 — the smallbins are doubly-linked and handed out from the tail. Overwrite a smallbin chunk's bk to point at a fake chunk and malloc will walk right into it, returning a chunk on the stack. The unlink check just needs a back-pointer. https://algoatson.github.io/p/the-house-of-orange/ https://algoatson.github.io/p/the-house-of-orange/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 9, the capstone — no free() in the binary at all. Force malloc to free the top chunk for you, leak libc from it, then turn the unsorted bin attack into a forged FILE struct whose vtable call drops a shell. Heap meets FSOP. https://algoatson.github.io/p/the-house-of-rabbit/ https://algoatson.github.io/p/the-house-of-rabbit/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 13 — fastbins don't consolidate… until malloc_consolidate sweeps them. Forge a fastbin chunk's size to something enormous, trigger the sweep, and that little chunk becomes a giant free chunk overlapping everything after it. Overlap from almost no primitive. https://algoatson.github.io/p/the-unsorted-bin-attack/ https://algoatson.github.io/p/the-unsorted-bin-attack/ Sat, 13 Jun 2026 00:00:00 +0000 heappwnglibc Part 5 — corrupt one freed chunk's bk and the next malloc writes a libc pointer to an address you choose. You control WHERE, not WHAT — which sounds useless until you aim it at global_max_fast and unlock the whole fastbin. https://algoatson.github.io/p/unsafe-unlink/ https://algoatson.github.io/p/unsafe-unlink/ Fri, 12 Jun 2026 00:00:00 +0000 heappwnglibc Part 4 — when a free chunk is pulled out of a doubly-linked list, four pointer writes happen. Forge the pointers and one of them lands wherever you want. Then the modern twist: how to pass the "corrupted double-linked list" check that was supposed to kill this. https://algoatson.github.io/p/fastbin-dup/ https://algoatson.github.io/p/fastbin-dup/ Thu, 11 Jun 2026 00:00:00 +0000 heappwnglibc Part 3 — free a fastchunk twice past glibc's one-line double-free check, get the same chunk handed out twice, then poison its fd to allocate straight onto __malloc_hook. The classic that teaches "allocate where you want". https://algoatson.github.io/p/the-rendering-reference/ https://algoatson.github.io/p/the-rendering-reference/ Wed, 10 Jun 2026 00:00:00 +0000 metareference every block this site knows how to render, in one scroll — listings, the checksec panel, admonitions, spoilers, tables, footnotes. The other seed post is the gentle tour; this one is the exhaustive list, and my regression test. https://algoatson.github.io/p/house-of-force/ https://algoatson.github.io/p/house-of-force/ Tue, 09 Jun 2026 00:00:00 +0000 heappwnglibc Part 2 — overwrite the top chunk's size with -1 and malloc will hand you a chunk anywhere in the address space. The cleanest "arbitrary allocation" there ever was, and a clean look at why glibc 2.29 killed it. https://algoatson.github.io/p/glibc-heap-internals/ https://algoatson.github.io/p/glibc-heap-internals/ Mon, 08 Jun 2026 00:00:00 +0000 heappwnglibc Part 1 of the heap series — the only internals that matter for exploitation: chunk anatomy, the size field's flag bits, and the six places a free chunk can live (tcache, fastbins, unsorted, small, large, top). Everything later is corrupting one of these on purpose. https://algoatson.github.io/p/ptr-mangle-exit-handlers/ https://algoatson.github.io/p/ptr-mangle-exit-handlers/ Sun, 07 Jun 2026 00:00:00 +0000 pwnglibcinternals glibc stores some function pointers — atexit handlers, TLS destructors, jmp_buf — mangled with a secret guard so you can't just overwrite them with a target. Read how the mangle works, where its guard lives (fs:0x30, the canary's neighbour), and the two moves that defeat it: leak the guard, or zero it. https://algoatson.github.io/p/reading-int-free-source-review/ https://algoatson.github.io/p/reading-int-free-source-review/ Sat, 06 Jun 2026 00:00:00 +0000 heapglibcinternals Every heap exploit is a negotiation with the checks in _int_free. This is a guided read of glibc's free path — each malloc_printerr in order, what corrupted state it inspects, and exactly which attack it was added to kill. Know the gates and you know which technique survives on which libc. https://algoatson.github.io/p/cet-shadow-stack-ibt/ https://algoatson.github.io/p/cet-shadow-stack-ibt/ Fri, 05 Jun 2026 00:00:00 +0000 pwninternals Intel CET puts return addresses on a second, hardware-protected stack and demands every indirect branch land on an endbr64. That ends classic ROP and JOP. It does not end exploitation — whole-function calls, data-only attacks, and the occasional shadow-stack write all walk right past it. https://algoatson.github.io/p/tcache-stashing-unlink/ https://algoatson.github.io/p/tcache-stashing-unlink/ Thu, 04 Jun 2026 00:00:00 +0000 heappwnglibc When a smallbin serves a request, glibc stashes the leftover chunks into the tcache — and that stashing does a doubly-linked-list unlink with a far weaker check than the real thing. Corrupt one bk pointer and you get a libc write and an allocation at an address you choose. https://algoatson.github.io/p/dirty-pipe-cve-2022-0847/ https://algoatson.github.io/p/dirty-pipe-cve-2022-0847/ Wed, 03 Jun 2026 00:00:00 +0000 kernelpwn A pipe buffer's flags field was left uninitialised, so a stale PIPE_BUF_FLAG_CAN_MERGE let a write() spill into the page cache of a file you only opened read-only. No memory corruption, no ROP — just a missing assignment that turns "read a file" into "overwrite it". A source review of one of the cleanest LPEs in years. https://algoatson.github.io/p/arm64-pac-and-mte/ https://algoatson.github.io/p/arm64-pac-and-mte/ Tue, 02 Jun 2026 00:00:00 +0000 pwninternalsarm ARMv8.3 signs pointers with a cryptographic MAC in their spare bits; ARMv8.5 tags every allocation with a 4-bit lock the pointer must match. Both are real upgrades over the stack canary — and both are beaten by the same old moves: a leak, a signing gadget, or a brute force the field is too small to resist. https://algoatson.github.io/p/rizin-radare2-in-anger/ https://algoatson.github.io/p/rizin-radare2-in-anger/ Tue, 02 Jun 2026 00:00:00 +0000 retooling The terminal reverse-engineering workflow — open, analyse, navigate, search, patch, and debug a binary without ever leaving the prompt. The commands I actually use, plus where rizin and radare2 diverge. https://algoatson.github.io/p/setcontext-register-control/ https://algoatson.github.io/p/setcontext-register-control/ Sun, 31 May 2026 00:00:00 +0000 pwnropinternals A single controlled call — from a hook, an FSOP vtable, a function pointer — sets one register and jumps once. setcontext turns that into everything: it restores rsp and the whole register file from a struct you point it at, converting one redirect into a full pivot. The modern bridge from "I control one call" to "I control the machine". https://algoatson.github.io/p/stack-pivoting/ https://algoatson.github.io/p/stack-pivoting/ Sat, 30 May 2026 00:00:00 +0000 pwnrop You control the return address but only have room for two or three gadgets after it. Pivot the stack: point rsp at a buffer you fully control and run the real chain from there. leave;ret, pop rsp, xchg — the move that turns a cramped overflow into unlimited ROP. https://algoatson.github.io/p/pwntools-cookbook/ https://algoatson.github.io/p/pwntools-cookbook/ Tue, 26 May 2026 00:00:00 +0000 pwntoolingctf The pwntools I reach for from memory — the template, tubes, packing, the ELF/libc helpers, format-string and shellcode one-liners, and the CLI subcommands that replace a pile of little scripts. Real snippets, copy-paste shaped. https://algoatson.github.io/p/writeup-static-srop/ https://algoatson.github.io/p/writeup-static-srop/ Tue, 26 May 2026 00:00:00 +0000 pwnropctf A stripped, statically-linked binary with a stack overflow and almost nothing else — no PLT, no libc to leak, barely any gadgets. The way out is to write "/bin/sh" with a read, then chain two forged sigreturn frames into an execve. A clean SROP from recon to shell. https://algoatson.github.io/p/srop-one-syscall-every-register/ https://algoatson.github.io/p/srop-one-syscall-every-register/ Fri, 22 May 2026 00:00:00 +0000 pwnrop A signal return restores the entire CPU state from a frame on the stack. Forge that frame and a single rt_sigreturn sets rax, rdi, rsi, rdx, rip and rsp at once — the densest gadget in the binary, perfect when you have almost nothing to work with. https://algoatson.github.io/p/checksec-everything/ https://algoatson.github.io/p/checksec-everything/ Tue, 19 May 2026 00:00:00 +0000 toolingpwnctf A small workflow I paste into every CTF box — pull every binary's mitigations into one scannable list, run it from a single keybind, and stop re-typing checksec for the hundredth time. Glue, not genius. https://algoatson.github.io/p/writeup-notekeeper-uaf/ https://algoatson.github.io/p/writeup-notekeeper-uaf/ Mon, 18 May 2026 00:00:00 +0000 pwnheapctf A textbook menu-driven heap challenge, start to finish. A dangling pointer after delete gives a read and a write on freed memory; the unsorted bin leaks libc, tcache poisoning aims a freed chunk at __free_hook, and the program frees its way into a shell. https://algoatson.github.io/p/brop-blind-rop/ https://algoatson.github.io/p/brop-blind-rop/ Thu, 14 May 2026 00:00:00 +0000 pwnrop A remote service with a stack overflow, that forks per connection, and that you have no binary for. Blind ROP turns the only feedback you have — does the connection crash or not — into an oracle, and reads the canary, finds gadgets, and dumps the binary over the socket. The most elegant trick in the ROP toolkit.