Zero-Day Exploration: Understanding Buffer Overflows

The Stack Architecture

To understand how a buffer overflow exploit functions, one must first comprehend the structure of computer memory at execution time. The Stack is a contiguous region of memory operating under a Last-In, First-Out (LIFO) protocol. When a program calls a local function, it creates a new "Stack Frame" to hold local variables, function arguments, and critically, control data. The stack grows downward in memory, while arrays and buffers allocated inside stack frames write data upward, from lower memory addresses to higher memory addresses.

Inside every stack frame lies the **Saved Frame Pointer (SFP)** and the **Return Address (EIP / RIP)**. The Return Address tells the processor exactly where in the program's code segment to resume execution once the current function completes. Because buffers write upward, writing more data to a buffer than it was allocated to hold allows an attacker to overwrite the adjacent SFP and EIP values, hijacking the code execution stream.

// Vulnerable C Code lacking array length checks
#include <string.h>

void vuln_func(char *str) {
    char buffer[64];
    strcpy(buffer, str); // Bypasses limits - overwrites adjacent RIP addresses!
}

Hijacking the Instruction Pointer

When an attacker carefully crafts a payload for a vulnerable function, they calculate the exact distance (offset) from the start of the target buffer to the return address register. Once this offset is determined, the attacker packs the buffer with "junk" character bytes, overwrites the Return Address with a target memory location, and appends raw shellcode.

If the Return Address is pointed back into the buffer itself, the system jumps straight to the attacker's shellcode, executing arbitrary commands with the privileges of the running application. Modern compilers deploy "Stack Canaries"—random value tokens placed ahead of the return address—to prevent this. If a canary is modified, the program terminates immediately to safeguard execution blocks.