The stack is a memory region where a program stores temporary data –\u00a0like local variables and return addresses. Think of the stack as a pile of plates in your kitchen: you can only add a new plate to the top, and you can only take one away from the top too. Programs use this same “last in, first out” principle to keep track of what they’re doing. Every time a function is called, the program pushes a new plate onto the stack containing things like local variables and the address to return to once the function finishes. When the function is done, that plate is popped off the top, and execution resumes exactly where it left off. This simple mechanism is what allows programs to call functions within functions within functions, and always find their way back –\u00a0but it’s also precisely why a stack that grows too large, or gets overwritten with unexpected data, becomes a favorite target for attackers looking to hijack a program’s execution flow.<\/p>\n
In the SANS class FOR610[1<\/a>] (malware analysis), there is an introduction to assembly and, when students learn how functions work, they have to understand how the stack also works. If you\u2019ve no prior experience, it could be a bit challenging. To help students to vizualise how the stack works, I created a \u201cstack simulator\u201d that allows to \u201csee\u201d what\u2019s happening when code is executed.<\/p>\n How does it work?<\/p>\n Note that you can modify the predefined ASM code and add your own instructions.<\/p>\n The stack simulator is available on my website[2<\/a>].<\/p>\n If you\u2019re interested\u00a0in malware analysis, my next classes will be:<\/p>\n [1]\u00a0https:\/\/www.sans.org\/cyber-security-courses\/reverse-engineering-malware-malware-analysis-tools-techniques<\/a> Xavier Mertens (@xme)<\/b> (c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n \t![\"\"](\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/isc-20260708-1.png?ssl=1\")
<\/p>\n\n
\n
\n[2]\u00a0https:\/\/xameco.be\/stack-simulator.html<\/a>
\n[3] https:\/\/www.sans.org\/cyber-security-training-events\/tokyo-autumn-2026<\/a>
\n[4] https:\/\/www.sans.org\/cyber-security-training-events\/paris-november-2026<\/a><\/p>\n
\nXameco<\/a>
\nSenior ISC Handler – Freelance Cyber Security Consultant
\nPGP Key<\/a><\/p>\n
\n
<\/BR><\/p>\n