OSEE key terms

A memory-safety flaw where a program writes more bytes into a fixed-size stack buffer than it can hold, overwriting adjacent locals, saved frame pointers, and the return address so control flow can be redirected.

The classic exploitation step in which an overflow on the stack replaces the saved return address with an attacker-chosen value, so the function's epilogue jumps to code the attacker selected.

The condition in which an attacker can set the instruction pointer to an arbitrary value, usually the prerequisite for redirecting execution to shellcode, a ROP chain, or an existing function.

Determining exactly how many input bytes are needed to reach a saved return address or another overwritten field, often done with a cyclic pattern and reading the crash value from a debugger or core dump.

A non-repeating byte sequence of known layout used to fill a buffer so the value observed in a crashed register or stack slot reveals the exact offset at which the overwrite occurred.

A long run of no-operation instructions placed before shellcode so an imprecise jump landing anywhere inside the run slides execution forward to the payload, tolerating address uncertainty.

Position-independent machine code an exploit injects or reuses to perform an action such as spawning a shell, reading a file, or connecting back to the attacker, written without null bytes when needed.

A very small payload that scans memory for a larger tagged payload (the egg) and jumps to it, used when the space available for injected code is too small to hold the full shellcode.

A random sentinel value placed between local buffers and saved control data; the function checks it before returning, and a mismatch aborts the process, blocking simple linear overflows.

Techniques that defeat canaries, including leaking the canary through an info leak, overwriting it via an arbitrary write, or targeting data that is not protected such as saved pointers or exception structures.

Address space layout randomization: the operating system randomizes base addresses of the stack, heap, libraries, and sometimes the executable, so hard-coded exploit addresses are unreliable across runs.

Data execution prevention, also called no-execute, marks writable memory such as the stack and heap non-executable, so injected shellcode cannot run and attackers must reuse existing executable code.

An exploitation technique that overwrites a return address with the address of a library function such as system or execve, arranging arguments on the stack, to run code without injecting executable bytes.

A code-reuse technique that chains short instruction sequences ending in a return, each called a gadget, to build arbitrary computation while defeating non-executable memory protections.

A short sequence of existing instructions ending in a return or indirect jump that performs a small useful operation, such as loading a register or making a syscall, when entered at its chosen offset.

An ordered list of gadget addresses and data placed on the stack so that successive returns execute each gadget in turn, typically to set up registers and invoke a syscall or function.

A tool that scans executable sections or libraries for byte sequences that decode to useful instructions followed by a return, jump, or call, and reports their addresses and side effects.

Changing the stack pointer to a region the attacker controls, such as a heap buffer, so a ROP chain or fake stack can be executed when the original overflow space is too small.

A flaw where user input is passed directly as a format argument, letting the attacker use conversion specifiers to read stack values, write to arbitrary addresses with %n, or crash the process.

Any bug that discloses memory contents or addresses to the attacker, such as an uninitialized buffer, out-of-bounds read, or format string, and is often what makes ASLR and canaries beatable.

Overwriting only the low bytes of a pointer or return address so the high, randomized bytes stay valid, allowing a redirect within the same page or region without knowing the full address.

A write past the end of a heap-allocated buffer that corrupts adjacent chunk metadata or neighboring objects, potentially leading to arbitrary write or control-flow hijack during allocation or free.

A bug where memory is freed but still referenced; if the attacker can reallocate that chunk with controlled data, later use of the stale pointer operates on attacker-chosen contents, often a vtable or function pointer.

Deliberately arranging allocations and frees so that a target object lands next to, or reuses, a chunk the attacker controls, making a heap corruption primitive reliable instead of probabilistic.

Filling large parts of the heap with repeated copies of a payload or fake structure so that a corrupted pointer or guessed address is likely to land on attacker-controlled data.

A glibc heap technique that corrupts a freed chunk's tcache next pointer so the next allocation returns an arbitrary address, giving a write-what-where primitive when combined with controlled data.

A flaw where an object of one type is treated as another, so fields are interpreted at the wrong offsets and a value the attacker controls can be used as a pointer or function reference.

Overwriting an object's vtable pointer or a function pointer so that a later virtual dispatch calls an address the attacker chose, a common route from a memory bug to code execution.

A primitive that lets the attacker store a chosen value at a chosen address; combined with a known target such as a function pointer or GOT entry, it usually yields code execution.

Replacing a dynamic linker global offset table entry with an attacker address so the next call to that imported function jumps to attacker-chosen code, a classic target for write primitives.

A linker hardening level where the global offset table remains writable after relocation, so a write primitive can redirect imported function calls; full RELRO makes the table read-only.

A small decoder routine prepended to encoded payload bytes; the decoder reconstructs the real shellcode at runtime, letting the payload avoid forbidden bytes such as nulls or pass signature checks.

The first pass over a crashing input: reproducing it, checking which registers and memory were corrupted, and deciding whether the crash is exploitable or only a denial of service.

Automated testing that feeds generated or mutated inputs to a target to find crashes and hangs, which are then triaged as potential memory-corruption vulnerabilities worth exploiting.

A system call that changes page permissions; exploits sometimes call it to mark a writable region executable, restoring a place to run injected shellcode after bypassing non-executable memory.

A code-reuse attack that invokes a signal-return syscall with a forged frame on the stack, letting the attacker set nearly all registers at once with very few gadgets.

Arithmetic that wraps past a type's range, producing a small or negative size; when that value drives allocation or bounds checks, it can lead to undersized buffers and subsequent memory corruption.

A bounds error that writes exactly one byte past a buffer's end, enough to corrupt an adjacent length field, chunk size, or saved pointer and enable a larger follow-on exploit.