Executable Exports Symbols
There are actually several critical scenarios where an executable must export symbols. The confusion usually lies in the direction of the linking. You are right that Executable A rarely links…
Category: Knowledge Base
Tailcall in AArch64
In AArch64 (ARM64), for a tail call to work, the current function must tear down its own stack frame before branching to the next function. If it didn't, the stack…
AFL_SKIP_BIN_CHECK
export AFL_SKIP_BIN_CHECK=1 is an environment variable setting that tells AFL++ to stop complaining that your target program doesn't look like it was compiled with AFL. By default, AFL++ checks your…
LDR vs. LDUR in AArch64
In AArch64 (ARMv8-A), the main difference between LDR and LDUR is how they handle the immediate offset from the base address. LDR (Load Register): Uses a scaled positive immediate offset.…
The difference of overflow and underflow
In computer science—and specifically in fuzzing and exploitation—the terms Overflow and Underflow mean different things depending on whether you are talking about Numbers (Arithmetic) or Memory (Buffers). Here is the…
Memory Layout(global data, code, stack, heap, etc) with TLS
On AArch64 (ARM64), the memory layout for Thread Local Storage (TLS) follows TLS Variant 1. This is distinct from x86_64 (which uses Variant 2). The key difference is the location…
AFL Coverage Instrumentation Callback
0000000000000bc0 <bbCallback>: bc0: 90000102 adrp x2, 20000 <_exit@GLIBC_2.17> bc4: f9404c43 ldr x3, [x2, #152] bc8: b4000263 cbz x3, c14 <bbCallback+0x54> bcc: d53bd042 mrs x2, tpidr_el0 bd0: a9bf7bfd stp x29, x30,…
Executable Startup And Initialization
CRT (C Runtime) "glue code" refers to a set of pre-compiled object files (typically crt1.o, crti.o, crtn.o, crtbegin.o, and crtend.o) that are automatically linked with your program. They "glue" the…
The difference between soundness and completeness
In logic and computer science, soundness and completeness are two fundamental properties of a formal system (a set of rules for proving things). They describe the relationship between Provability (can…
Global variable declaration inside function (Python
If you only want to read (access) the value of a global variable, you do not need the global keyword. Python automatically looks up the variable in the global scope…