How Computers Work

CPU, RAM, storage, the OS kernel, and how process memory is laid out — essential for understanding exploits.

Easy 35m 3 tasks
Prerequisites: The Security Mindset

Learning Objectives

  • Describe roles of CPU, RAM, and storage
  • Explain kernel space vs user space
  • Read a process memory layout (stack, heap, text, data, BSS)
  • Understand why buffer overflows target the stack

How a Computer Works

Core Components

Component Role
CPU Executes instructions
RAM Fast temporary storage (volatile)
Storage (HDD/SSD) Permanent storage
Motherboard Connects all components
GPU Graphics processing (also used in ML/crypto)
NIC Network connectivity

CPU Internals

  • ALU (Arithmetic Logic Unit) — performs math and logic operations
  • Control Unit — fetches and decodes instructions
  • Registers — tiny super-fast storage (8-64 bytes)
  • Cache (L1/L2/L3) — faster than RAM, slower than registers

Fetch-Decode-Execute Cycle

1. FETCH     Read instruction from RAM at address in Program Counter
2. DECODE    Decode what operation to perform
3. EXECUTE   ALU performs the operation
4. STORE     Write result to register/memory
5. INCREMENT PC  Move to next instruction

What Is an Operating System?

An OS is software that manages hardware resources and provides an environment for applications to run.

OS Functions

  1. Process Management — create, schedule, terminate processes
  2. Memory Management — allocate/deallocate RAM, virtual memory
  3. File System — organise files on storage devices
  4. Device Management — drivers, I/O operations
  5. Security — access control, user isolation
  6. Networking — TCP/IP stack integration

Kernel vs User Space

User Space:   Applications, shells, libraries (restricted access)
─────────────────────────────────────────
Kernel Space: OS core, device drivers (full hardware access)
              Handles: syscalls, interrupts, hardware abstraction

User programs request kernel services via system calls (syscalls): open(), read(), write(), fork(), exec().

Processes & Threads

  • Process — an instance of a running program with its own memory space
  • Thread — a lightweight unit within a process sharing its memory
  • Context switch — OS saves state of current process and loads another
# View processes
ps aux
top
htop

# Process tree
pstree

OS Families

OS Kernel Use case
Windows NT kernel Desktop, enterprise
Linux Linux kernel Servers, security tools
macOS XNU (Darwin) Desktop, development
Android Linux kernel Mobile
iOS XNU Mobile

Before you exploit a system, you must understand what you're attacking. These three hardware components form the core of every computer.

ComponentRoleSecurity relevance
CPUExecutes instructions (fetch-decode-execute)Spectre/Meltdown side-channel attacks exploit CPU caches
RAMFast volatile storage — holds running programsStack/heap overflows write into RAM; cold boot attacks dump it
Storage (SSD/HDD)Persistent data — survives power offFile carving, forensics, FDE (full-disk encryption) protects it
NICNetwork interface — sends/receives packetsPromiscuous mode enables sniffing; MAC addresses can be spoofed
Fetch-Decode-Execute Cycle
1
Fetch

CPU reads the next instruction from RAM at the address in the Program Counter (PC/RIP register)

2
Decode

CPU interprets the opcode: MOV, ADD, JMP, CALL…

3
Execute

CPU performs the operation, updates registers and memory, increments PC

⚠ Security: Buffer overflows overwrite the saved return address on the stack. When the function RETurns, the CPU fetches the attacker's address from the stack instead of the legitimate one.
✦ Answer the questions to complete this task

Which hardware component holds running programs and is lost on power-off?

What does the Program Counter (PC) register store?

When the OS runs a program, it maps the process into virtual memory in distinct regions. Understanding this layout is fundamental to binary exploitation.

Process Memory Layout (high → low)
RegionContainsGrowsAttack relevance
StackLocal variables, return addresses, saved regsDownward ↓Buffer overflows → overwrite return address
Heapmalloc/new dynamic allocationsUpward ↑Heap overflow, use-after-free, double-free
BSSUninitialised global/static varsFixedFormat string bugs
DataInitialised globals and staticsFixedGlobal variable overwrites
TextProgram code (read + execute)FixedCode injection targets this; DEP/NX protects it
ASLR (Address Space Layout Randomisation) randomises where Stack, Heap, and libraries are loaded each run — making hardcoded addresses in exploits fail.
✦ Answer the questions to complete this task

A classic stack buffer overflow overwrites which value to redirect execution?

What does ASLR protect against?

The OS enforces a hard boundary between kernel space (privileged) and user space (unprivileged). Understanding this boundary explains privilege escalation.

🔴 Kernel Space (Ring 0)

  • Full hardware access
  • Runs OS code, device drivers
  • Unrestricted memory access
  • User code can't run here directly
Kernel exploit = total compromise

🔵 User Space (Ring 3)

  • Restricted — can't access hardware directly
  • Must request kernel via syscall
  • Each process isolated from others
  • Most applications run here
User exploit = limited to user privileges
# Common syscalls (user space → kernel) open('/etc/passwd', O_RDONLY) # open a file read(fd, buf, 100) # read bytes write(1, buf, 100) # write to stdout execve('/bin/sh', args, env) # run a new program # strace — watch syscalls a process makes strace ls
⚠ Security: Privilege escalation (privesc) = moving from user space to kernel space or root. A kernel exploit achieves this directly. SUID binaries misuse it indirectly.
✦ Answer the questions to complete this task

User space programs communicate with the kernel through:

Why is a kernel exploit more dangerous than a user-space exploit?

💪 Exercises & Challenges

📝 MCQ Easy +20 XP

Operating Systems & Processes Quiz

Check your understanding of how computers and operating systems work.

Start →
🚩 Challenge Medium +25 XP

Find the Privilege Escalation Vector

Identify the SUID binary that could be abused for privilege escalation.

Start →
⚙️ Practical Easy +25 XP

File System Navigation Lab

## Task: Explore and Manipulate the File System ```bash # 1. Create a workspace mkdir ~/cyberlab && cd ~/cyberlab # 2. Create files touch notes.txt config.cfg secret.key # 3. Set permissions chmod

Start →
🚩 Challenge Easy +50 XP

Permission Puzzle

What are the octal permissions for `rw-r-----`? Submit: `FLAG{octal}`

Start →

🔗 Related Lessons