Stack Frame Layout

Updated 13 Sep 2026

•
What it is
- •
  The arrangement of local variables, saved registers, and return information on the stack. Deriving their offsets shows exactly where an overflow lands.
•
How it works
- •
  With a conventional frame-pointer prologue (push rbp; mov rbp, rsp), saved rbp is at [rbp] and the return address at [rbp+8]. Optimized or unusual frames may differ.
- •
```
High addresses
[ return addr   ] ← rbp + 0x8
[ saved rbp     ] ← rbp + 0x0
[ ...           ]
[ local buffer  ] ← rbp - offset (offset read directly off disassembly)
Low addresses (rsp)
```
- •
  To get the distance from a buffer to the return address: take the buffer's rbp-relative offset (magnitude) and add 0x8 (past the saved rbp slot).
•
When to use it
- •
  Any time you have (or can get) a disassembly and need an exact overflow offset rather than guessing or brute-forcing with a cyclic pattern — look for the lea/mov that establishes the buffer pointer relative to rbp.
- •
  For two locations relative to the same frame pointer, subtract their offsets; an absolute address is unnecessary.
•
Examples
- •
  Buffer at rbp-0x80, return address at rbp+8: the distance is 0x88 (136 bytes).
- •
  Buffers at rbp-0x2c0 and rbp-0x11 are 0x2af (687 bytes) apart.

pwntools

pattern = cyclic(200)
offset = cyclic_find(0x6161616b)  # Use a value observed in the crash.