Skill UI

This skill provides a comprehensive guide to detecting and analyzing heap spray exploitation techniques from raw memory dumps. Utilizing Volatility3's advanced plugins (such as malfind and vadinfo), users can identify key forensic artifacts like NOP sled patterns, suspicious executable memory regions, and embedded shellcode. It is essential for malware analysts and digital forensics investigators conducting incident response.

This curriculum covers foundational exploitation techniques essential for binary security analysis. Users will learn to control program execution flow, including overwriting EIP/RIP, constructing ROP chains, implementing ret2libc, and shellcode injection. It provides practical, hands-on exercises on stack overflows and heap manipulation in a controlled Linux environment, establishing the core primitives needed before tackling modern mitigation bypasses.

A comprehensive playbook detailing advanced techniques for exploiting glibc heap vulnerabilities using ptmalloc2. Covers various memory corruption primitives, including Use-After-Free, double free, and overflows. Provides version-specific guidance on bypassing modern protections like safe-linking (glibc >= 2.32) and RCE methods for post-2.34 environments.