How Computers Work
CPU, RAM, storage, the OS kernel, and how process memory is laid out — essential for understanding exploits.
Learning Objectives
- → Describe roles of CPU, RAM, and storage
- → Explain kernel space vs user space
- → Read a process memory layout (stack, heap, text, data, BSS)
- → Understand why buffer overflows target the stack
How a Computer Works
Core Components
| Component | Role |
|---|---|
| CPU | Executes instructions |
| RAM | Fast temporary storage (volatile) |
| Storage (HDD/SSD) | Permanent storage |
| Motherboard | Connects all components |
| GPU | Graphics processing (also used in ML/crypto) |
| NIC | Network connectivity |
CPU Internals
- ALU (Arithmetic Logic Unit) — performs math and logic operations
- Control Unit — fetches and decodes instructions
- Registers — tiny super-fast storage (8-64 bytes)
- Cache (L1/L2/L3) — faster than RAM, slower than registers
Fetch-Decode-Execute Cycle
1. FETCH → Read instruction from RAM at address in Program Counter
2. DECODE → Decode what operation to perform
3. EXECUTE → ALU performs the operation
4. STORE → Write result to register/memory
5. INCREMENT PC → Move to next instruction
What Is an Operating System?
An OS is software that manages hardware resources and provides an environment for applications to run.
OS Functions
- Process Management — create, schedule, terminate processes
- Memory Management — allocate/deallocate RAM, virtual memory
- File System — organise files on storage devices
- Device Management — drivers, I/O operations
- Security — access control, user isolation
- Networking — TCP/IP stack integration
Kernel vs User Space
User Space: Applications, shells, libraries (restricted access)
─────────────────────────────────────────
Kernel Space: OS core, device drivers (full hardware access)
Handles: syscalls, interrupts, hardware abstraction
User programs request kernel services via system calls (syscalls): open(), read(), write(), fork(), exec().
Processes & Threads
- Process — an instance of a running program with its own memory space
- Thread — a lightweight unit within a process sharing its memory
- Context switch — OS saves state of current process and loads another
# View processes
ps aux
top
htop
# Process tree
pstree
OS Families
| OS | Kernel | Use case |
|---|---|---|
| Windows | NT kernel | Desktop, enterprise |
| Linux | Linux kernel | Servers, security tools |
| macOS | XNU (Darwin) | Desktop, development |
| Android | Linux kernel | Mobile |
| iOS | XNU | Mobile |
Before you exploit a system, you must understand what you're attacking. These three hardware components form the core of every computer.
| Component | Role | Security relevance |
|---|---|---|
| CPU | Executes instructions (fetch-decode-execute) | Spectre/Meltdown side-channel attacks exploit CPU caches |
| RAM | Fast volatile storage — holds running programs | Stack/heap overflows write into RAM; cold boot attacks dump it |
| Storage (SSD/HDD) | Persistent data — survives power off | File carving, forensics, FDE (full-disk encryption) protects it |
| NIC | Network interface — sends/receives packets | Promiscuous mode enables sniffing; MAC addresses can be spoofed |
CPU reads the next instruction from RAM at the address in the Program Counter (PC/RIP register)
CPU interprets the opcode: MOV, ADD, JMP, CALL…
CPU performs the operation, updates registers and memory, increments PC
Which hardware component holds running programs and is lost on power-off?
What does the Program Counter (PC) register store?
When the OS runs a program, it maps the process into virtual memory in distinct regions. Understanding this layout is fundamental to binary exploitation.
| Region | Contains | Grows | Attack relevance |
|---|---|---|---|
| Stack | Local variables, return addresses, saved regs | Downward ↓ | Buffer overflows → overwrite return address |
| Heap | malloc/new dynamic allocations | Upward ↑ | Heap overflow, use-after-free, double-free |
| BSS | Uninitialised global/static vars | Fixed | Format string bugs |
| Data | Initialised globals and statics | Fixed | Global variable overwrites |
| Text | Program code (read + execute) | Fixed | Code injection targets this; DEP/NX protects it |
A classic stack buffer overflow overwrites which value to redirect execution?
What does ASLR protect against?
The OS enforces a hard boundary between kernel space (privileged) and user space (unprivileged). Understanding this boundary explains privilege escalation.
🔴 Kernel Space (Ring 0)
- Full hardware access
- Runs OS code, device drivers
- Unrestricted memory access
- User code can't run here directly
🔵 User Space (Ring 3)
- Restricted — can't access hardware directly
- Must request kernel via syscall
- Each process isolated from others
- Most applications run here
User space programs communicate with the kernel through:
Why is a kernel exploit more dangerous than a user-space exploit?
💪 Exercises & Challenges
Operating Systems & Processes Quiz
Check your understanding of how computers and operating systems work.
Find the Privilege Escalation Vector
Identify the SUID binary that could be abused for privilege escalation.
File System Navigation Lab
## Task: Explore and Manipulate the File System ```bash # 1. Create a workspace mkdir ~/cyberlab && cd ~/cyberlab # 2. Create files touch notes.txt config.cfg secret.key # 3. Set permissions chmod
Permission Puzzle
What are the octal permissions for `rw-r-----`? Submit: `FLAG{octal}`