A local buffer is filled from its own low address upward; on x86/ARM the region right after it on the stack holds, in order, the canary, the saved frame pointer and the return address:
buffer[B] → canary[4] → saved frame ptr[8] → return address[8] → caller's stack…
overflow = max(0, L − B)
The byte tape at the top of the canvas is that memory laid out left→right instead of as a 3D column: each cell is one byte, colour-coded by region, and the write cursor sweeps across it as the payload lands. If the overflow reaches the canary it trips before RET runs; if it reaches the return address with no canary trip, the address is corrupted.
A corrupted return address is not automatically a working exploit — that's what the bottom "odds" panel simulates independently. Without ASLR the attacker already knows the target address, so a hijack succeeds with certainty. With ASLR the stack base is drawn uniformly from 2^entropy possible positions, so a single blind guess succeeds with probability:
P(hit) = 1 / 2^entropy
E[hits over N guesses] = N·P(hit), σ = √(N·P(hit)·(1−P(hit)))
"Run guess batch" fires N independent simulated guesses (Bernoulli trials at that probability) and plots the running hit rate against the theoretical line — with realistic entropy (28+ bits on modern 64-bit Linux) the dots almost never light up, which is the whole point of ASLR as a mitigation.
- Stack canary — random guard value re-checked before
RET; any overflow that reaches it aborts the process before the return address is ever used.
- ASLR entropy — bits of randomness in the stack base address; each extra bit halves the blind-guess success probability.
- Guesses per batch — how many simulated attack attempts run per click, feeding the empirical-vs-theoretical comparison below the byte tape.