# Memory Corruption Playground

> A playful, local-only memory map simulator that teaches buffer overflows, use-after-free, and double free.

- Source: https://stevenfoerster.com/lab/memory-playground/

Lab

A playful, local-only memory map simulator that teaches buffer overflows, use-after-free, and double free.

Local-only simulation

Everything runs in your browser. No server calls, no uploads, and no tracking.

Builder notes

This lab is intentionally practical: run the guided path once, then flip to free play and observe exactly how each action mutates memory state.

-   Start with story mode so each bug class is introduced step-by-step.
-   Use free play to compare overflow, UAF, and double-free side effects.
-   Enable advanced mode to reason about return-address corruption.

Learning resources

-   [Aleph One: Smashing the Stack for Fun and Profit](https://insecure.org/stf/smashstack.html)
-   [CTF101 binary exploitation overview](https://ctf101.org/binary-exploitation/overview/)
-   [pwn.college](https://pwn.college/)

These are background references; this lab is a visual simulator, not a real debugger.

## Memory map

Each cell is one byte. Stack is short-lived. Heap is long-lived.

Danger: Low

Stack

Heap

Corruption

Boundary

## Story mode

Five guided steps. Use Next/Back to replay the scenarios.

 Free Play

Step 1 of 5

Safe write: store 12 bytes inside a 16-byte buffer.

Try this: click a few bytes inside the highlighted block.

Back Next

What you just learned

-   Buffer sizes define safe boundaries.
-   Overflows can alter neighboring data.
-   Freed memory can be reused by new allocations.
-   Use-after-free lets old pointers change new data.
-   Double-free corrupts allocator state.

## Actions

These buttons trigger the simulations. Enable Free Play to use them anytime.

Write data safely Overflow buffer Free block Use-after-free Double free Reset / New run

 Advanced: show return address overwrite

## Code View

C

Safe write: data fits within buffer bounds.

```
char buffer[16];
char *data = "Hello World!"; // 12 bytes

memcpy(buffer, data, 12);
// Safe: 12 <= 16
```

✓

Write stays within allocated bounds.

## Explain what happened

The write stayed inside the buffer. Only those bytes changed.

Why it matters: staying in bounds preserves nearby data.

Try this: click boundary cells to see the highlight.

## Danger meter

0 / 100

Educational simulation

This is a simplified model for learning. No real exploitation is performed here.