Simulations

Interactive CPU simulations. Step through assembly programs and watch registers, memory, and flags update in real time.

CPU Basics

Add Two Numbers

Load two values into registers and add them together. The simplest possible program.

Understanding CPU Flags

Run several comparisons and watch how the CPU flags change. Equal values set the zero flag, smaller-than sets the negative flag - flags are how the CPU remembers comparison results.

4 steps

Registers & Instruction Sets

View lessons

Conditional Jump

Use CMP and JZ to make decisions. If two numbers are equal, jump to a different part of the program.

4 steps

Counting Loop

Use a loop to count from 0 to 5. Demonstrates jumps, comparison, and incrementing.

4 steps

The Stack & The Heap

View lessons

Stack Push & Pop

Push values onto the stack and pop them off. See how the stack pointer moves and LIFO ordering works.

4 steps

Function Call & Return

Call a function that doubles a value. See how CALL saves the return address and RET jumps back.

4 steps

Nested Function Calls

Call a function that calls another function. Watch the stack grow with return addresses as calls nest, then unwind as each function returns.

4 steps

Memory Fundamentals

View lessons

Memory Read & Write

Store a value to a memory address and read it back. Understand how LOAD and STORE work with memory.

4 steps

Logic Gates

View lessons

Bitwise AND, OR, NOT

Apply bitwise AND, OR, and NOT to register values and watch how individual bits change. The foundation of all digital logic.

4 steps

Binary & Number Systems

View lessons

Bit Shifting

Shift bits left and right inside a register. Shifting left multiplies by 2, shifting right divides by 2 - the basis of fast arithmetic.

4 steps

Assembly Language

View lessons

Fibonacci Sequence

Compute the first Fibonacci numbers using a loop. Each number is the sum of the two before it - a classic algorithm exercise at the register level.

4 steps

Addresses & Pointers

View lessons

Array in Memory

Store a sequence of values at consecutive memory addresses and read them back. This is how arrays work at the lowest level - just numbers at adjacent addresses.

3 steps

Stack-Based Buffer Overflows

View lessons

Safe Buffer Write

A function writes exactly into its 3-slot buffer on the stack. The return address is untouched and RET works normally.

3 steps

Buffer Overflow

Write one element too many into a 3-slot buffer. The fourth write clobbers the return address - the CPU would jump to the wrong place.

4 steps

Controlled Overflow

An attacker deliberately overwrites the return address with a chosen value, redirecting execution to their target address.

4 steps

Heap Vulnerabilities & Use-After-Free

View lessons

Bump Allocator

A simple bump allocator allocates objects at consecutive heap addresses by advancing a free pointer.

3 steps

Use-After-Free

Free a memory region, allocate a new object in the same space, then read through the old pointer - it sees the new object's data.

4 steps

Return-Oriented Programming

View lessons

Gadget Identification

Three small instruction sequences (gadgets) each ending in RET. Call them individually to see each one perform its single operation.

3 steps

ROP Chain

Place gadget addresses on the stack and let RET chain through them - no CALL instructions needed. This is the core ROP mechanism.

3 steps

Integer Overflows & Type Confusion

View lessons

Integer Overflow Bypass

Watch an 8-bit register overflow from 15 to 1 when 2 is added. The wrapped value passes a size check it should have failed, demonstrating how overflow leads to security bypasses.

4 steps

Type Confusion

Store a value intended as a 'pointer' (address 15), then read it back and use it as a loop counter. The same bits mean completely different things depending on interpretation.

4 steps

Exploit Mitigations

View lessons

Stack Canary Detection

Place a canary value between a buffer and return address. A simulated overflow corrupts the canary, and the check detects the corruption before the function returns.

4 steps

DEP / NX Concept

Write instruction-like bytes to a stack area and jump there. In our simulator this executes, but a real CPU with DEP would fault and terminate the process.

2 steps

Exploit Development & Real-World Impact

View lessons

Full Exploit Chain

Complete exploit: overflow a buffer to overwrite the return address, redirecting execution to attacker-controlled code that stores a marker value.

4 steps

Finding the Offset

Write a unique pattern of bytes to consecutive memory addresses to determine which offset overwrites the return address. The pattern value at the return address location reveals the exact offset.

3 steps

Concurrency & Race Conditions

View lessons

Race Condition: Lost Update

Two 'threads' increment a shared counter, but interleaving causes a lost update. Thread B reads the old value before Thread A finishes writing, so one increment is lost.

4 steps

Atomic Increment: No Lost Update

The same two-thread counter scenario, but this time each thread completes its full LOAD-ADD-STORE sequence before the other begins. No interleaving means no lost updates.

4 steps

Reverse Engineering Basics

View lessons

Function Prologue & Epilogue

A function saves registers, sets up its stack frame, uses local variables, then tears down the frame and restores registers before returning - the pattern you see in every compiled function.

4 steps

Embedded Systems & Firmware

View lessons

Memory-Mapped I/O: LED Toggle

Write to a 'device register' address to turn an LED on and off. In embedded systems, controlling hardware is just writing to special memory addresses.

4 steps