Buffer Overflow & Stack Smashing Simulator

Attacker Input

Bytes written 8 / 40

Defenses

Stack canaryAborts on return if corrupted

DEP / NX bitStack memory can't execute

ASLRRandomizes the target address

Outcome

Drag the slider to write past the 16-byte buffer, then Launch Attack.

Overflow

0 B

Canary

intact

Return addr.

not reached

Blind-guess odds

n/a

buffer (empty) buffer (in-bounds) canary (intact) overwritten return addr. hijacked / shellcode

How it works

A stack frame lays out, in address order: the local buffer, then (if the compiler adds one) a canary word, the saved frame pointer, and the return address the CPU jumps to when the function ends.

[ buffer 16B ][ canary 4B ][ saved FP 4B ][ return addr 4B ][ beyond 12B ]

Writing more bytes than the buffer holds (strcpy-style, no bounds check) overwrites whatever sits after it — that's a buffer overflow.

Stack canary — a secret value placed before the return address; the function checks it right before returning: canary_at_return XOR secret == 0. If overflow touched it, the check fails and the program aborts instead of jumping anywhere attacker-controlled.
DEP / NX bit — marks stack pages non-executable, so even a fully hijacked return address pointing at injected shellcode on the stack just faults instead of running it.
ASLR — randomizes the base stack address on every run, so an attacker who doesn't know the exact address can only blind-guess it. With b bits of address entropy, a single guess succeeds with probability P = 1 / 2^b (shown here with a simplified b = 16 for a demonstration-scale address space).

Real exploitation needs all three gaps at once: an unchecked overflow, a fully attacker-controlled return address, and somewhere executable to land — which is exactly why modern toolchains ship canaries, NX and ASLR together rather than any single one alone.

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.