[SYSTEM BRIEFING]

ACCESS LEVEL: TIER 02

INTEL TYPE: MEMORY VOLATILITY

TARGET: THE RUNTIME ENVIRONMENT

In Phase 1, we looked at static data. In Phase 2, we analyze data in motion. Every program you reverse engineer uses a specific area of RAM to store variables, return addresses, and function arguments. If you don’t understand the Stack, you cannot understand exploits like Buffer Overflows.

0x01: The Stack (LIFO Structure)

The Stack is a “Last-In, First-Out” structure. Imagine a stack of plates. You put a plate on top (PUSH), and you take the top plate off (POP).

• ESP / RSP: The Stack Pointer. It points to the very top of the stack.
• EBP / RBP: The Base Pointer. It points to the bottom of the current “function frame.”

0x02: The Heap (Dynamic Allocation)

While the Stack is organized and fast, the Heap is a large, messy pool of memory used for long-term storage. When a programmer uses malloc() in C++ or new in Java, they are requesting a chunk of the Heap.

• Relevance: This is where “Use-After-Free” vulnerabilities live.