Smash the stack. Understand every byte.

5 min read + experimentsUpdated 9 Nov 2026

An interactive stack buffer overflow course for CTF learners. Explore memory, return addresses and modern defenses through browser-only simulations.

Jump into the byte experiment

On this page

A buffer is a boundary, not a suggestion.

A stack-based buffer overflow writes beyond an array in a function’s stack storage. The bytes do not stop at a label saying “this array ends here.” They can change neighboring data or, in some layouts, a saved return address.

Make the boundary visible.

Predict what happens at fifteen characters, then sixteen. Move the slider to check. Remember: a C string needs a terminating zero byte too.

This optional overflow model becomes interactive with JavaScript. The lesson, explanations and checkpoint answer remain readable without it.

Think of numbered lockers: you own sixteen, but the copy keeps putting parcels in the next one. The parcels are ordinary bytes. Crossing the ownership boundary is the bug.

From “it crashed” to “I can explain why.”

This is a fresh, illustrated explanation of the paper you supplied: Aleph One’s Smashing the Stack for Fun and Profit, published in Phrack 49 in 1996. The core idea still matters. Its machine layout and exploit assumptions are historical, not a recipe for a current laptop.

Each lesson follows the same rhythm: predict, change one thing, inspect the state, explain the result. You can jump to a chapter, but frames make much more sense before offsets.

The rules of this little machine.

Every address is synthetic. Our 32-bit x86 model uses four-byte pointers and a frame-pointer-based layout selected for teaching.
All interaction is local JavaScript manipulating ordinary arrays and text. Nothing runs native code, compiles C, launches a shell or sends your simulation choices to a server.
The model is deterministic. Real out-of-bounds C behavior is undefined, so a real binary can behave differently even with the same source.
The site’s existing public-page analytics remain separate from the simulation. No new telemetry records slider values or quiz answers.

Basic C helps. Assembly expertise does not. When a register appears, we explain what job it is doing before asking you to reason about it.

Keep these six words nearby.

Buffer: A contiguous region reserved for some data, with a known capacity.
Byte: The addressable unit used in these examples: eight bits.
Address: A location in a process’s virtual memory, not a physical RAM coordinate.
Register: A small CPU storage location used for values such as the next instruction or stack position.
Stack frame: A function call’s working area and saved context, where the compiled code needs one.
Return address: The instruction location execution should resume at after a call.

Your turn. Call the outcome.

A char buffer[16] contains a C string. How many nonzero single-byte characters fit with a terminator?

Read the explanation

Fifteen characters plus one zero byte occupy sixteen bytes. This is byte capacity, not a universal Unicode character count.

Sources & what we changed

Based on the supplied text of Aleph One’s Smashing the Stack for Fun and Profit, Phrack 49, file 14, 8 November 1996. Original author credit remains with Aleph One. This independent OverWatch Labs explanation uses new prose, synthetic models and modern defensive notes; it is not endorsed by Phrack or the original author.

This lesson maps to: Introduction; Buffer Overflows; the complete paper as a reading route. Historical examples are described, not represented as current product vulnerabilities. We correct byte-addressability, array padding, terminator counting and the supplied return-address arithmetic rather than reproducing those errors.

Original shell-spawning byte arrays and platform-specific exploit drivers are replaced with symbolic models. The causal concepts are preserved; browser outcomes are not native exploitation evidence. Modern controls are editorial additions, not claims made by the 1996 paper.