Updated DS refs

2026-07-10 14:28:55 +02:00 · 2026-04-15 17:23:21 -04:00
parent 6d01ea5f24
commit 38b5b1bcb5
220 changed files with 33267 additions and 0 deletions
@@ -0,0 +1,186 @@
+# Week 2 Quiz: Debugging and Hacking Basics
+
+## Instructions
+Choose the best answer for each question. There is only one correct answer per question.
+
+---
+
+## Questions
+
+### Question 1
+What does "live hacking" mean in the context of embedded systems?
+
+A) Recompiling source code to change what a program does  
+B) Modifying a program while it is actively running on real hardware  
+C) Writing a new program to replace an existing one  
+D) Using Wi-Fi to remotely update firmware  
+
+> 📖 **Reference:** Week 2, Part 1 – "What is Live Hacking?"
+
+**Correct Answer: B**
+
+---
+
+### Question 2
+Which GDB command connects to the OpenOCD debug server running on the default port?
+
+A) `connect localhost:3333`  
+B) `attach openocd`  
+C) `target extended-remote :3333`  
+D) `link remote 3333`  
+
+> 📖 **Reference:** Week 2, Part 6, Step 4 – "Connect to the Remote Debug Server"
+
+**Correct Answer: C**
+
+---
+
+### Question 3
+Why is the string `"hello, world"` stored in flash memory (starting with address `0x10...`) rather than in RAM?
+
+A) Flash memory is faster to read than RAM  
+B) The string is a constant defined at compile time and stored in read-only flash  
+C) The compiler always puts strings in flash to save RAM  
+D) The Pico SDK forces all strings into flash for security  
+
+> 📖 **Reference:** Week 2, Part 2 – "Why This Matters for Our Hack"
+
+**Correct Answer: B**
+
+---
+
+### Question 4
+Why does the command `set $r0 = "hacky, world\r"` fail when used in GDB on a bare-metal embedded system?
+
+A) GDB does not support the `set` command  
+B) The string is too long to fit in the register  
+C) There is no `malloc()` available because there is no operating system or C runtime  
+D) Flash memory prevents any write operations through GDB  
+
+> 📖 **Reference:** Week 2, Part 10 – "The Failed Hack Attempt (Learning Why)"
+
+**Correct Answer: C**
+
+---
+
+### Question 5
+Why is address `0x20000000` (the start of SRAM) a safe place to write an injected string during the hack?
+
+A) It is in flash memory which is permanently writable  
+B) The stack lives at the bottom of SRAM so there is no risk of collision  
+C) It is in read-write SRAM and far from the stack, which grows downward from the top of SRAM  
+D) The bootrom reserves this address specifically for debug payloads  
+
+> 📖 **Reference:** Week 2, Part 11, Step 12 – "Understanding the Solution"
+
+**Correct Answer: C**
+
+---
+
+### Question 6
+Which GDB command correctly writes the string `"hacky, world\r"` into SRAM at address `0x20000000`?
+
+A) `write 0x20000000 "hacky, world\r"`  
+B) `set {char[14]} 0x20000000 = {'h','a','c','k','y',',',' ','w','o','r','l','d','\r','\0'}`  
+C) `poke 0x20000000 "hacky, world\r"`  
+D) `memset 0x20000000 "hacky, world\r" 14`  
+
+> 📖 **Reference:** Week 2, Part 11, Step 13 – "Create Our Malicious String in SRAM"
+
+**Correct Answer: B**
+
+---
+
+### Question 7
+What is the purpose of the `b.n 0x1000023a` instruction found at the end of `main`?
+
+A) It calls the `puts()` function  
+B) It returns from the `main` function back to the reset handler  
+C) It creates an infinite loop by jumping back to the `ldr r0` instruction  
+D) It branches to a NMI (Non-Maskable Interrupt) handler  
+
+> 📖 **Reference:** Week 2, Part 7, Step 6 – "Examine the Main Function" (instruction table)
+
+**Correct Answer: C**
+
+---
+
+### Question 8
+In the ARM Cortex-M33 calling convention, which register holds the first argument passed to a function?
+
+A) `r1`  
+B) `r0`  
+C) `sp`  
+D) `lr`  
+
+> 📖 **Reference:** Week 2, Part 7 – "The Key Insight" and Part 12, Step 15 – "Change r0 to Point to Our String"
+
+**Correct Answer: B**
+
+---
+
+### Question 9
+What does the GDB command `x/s $r0` display?
+
+A) The hexadecimal value stored in register `r0`  
+B) The 10 bytes of memory starting at the address in `r0`  
+C) The null-terminated string stored at the memory address contained in `r0`  
+D) The assembly instruction located at the address in `r0`  
+
+> 📖 **Reference:** Week 2, Part 9, Step 10 – "Examine What's in r0"
+
+**Correct Answer: C**
+
+---
+
+### Question 10
+Why does GDB say "automatically using hardware breakpoints for read-only addresses" when setting a breakpoint in flash?
+
+A) Hardware breakpoints are faster than software breakpoints  
+B) Software breakpoints work by modifying code in memory, but flash is read-only at runtime  
+C) The Pico 2 does not support software breakpoints at all  
+D) GDB defaults to hardware breakpoints for all embedded targets  
+
+> 📖 **Reference:** Week 2, Part 8, Step 7 – "Set a Strategic Breakpoint" (hardware breakpoints explanation)
+
+**Correct Answer: B**
+
+---
+
+## Answer Key
+
+1. B - Live hacking means modifying a program while it is actively running on real hardware
+2. C - `target extended-remote :3333` connects to the OpenOCD server on port 3333
+3. B - The string is a compile-time constant stored in read-only flash memory (.rodata)
+4. C - Bare-metal systems have no OS and no `malloc()` for GDB to allocate string memory
+5. C - SRAM starting at 0x20000000 is read-write and far from the stack at the top of SRAM
+6. B - The `set {char[N]} ADDRESS = {...}` syntax writes individual characters directly to memory
+7. C - `b.n` is a branch instruction that jumps back to create the infinite loop
+8. B - Register `r0` holds the first argument to a function in ARM calling convention
+9. C - `x/s` examines memory and displays it as a null-terminated string
+10. B - Software breakpoints require writing to code memory, which is impossible in read-only flash
+
+---
+
+## Scoring Guide
+
+- **10 correct**: Excellent! You have a strong grasp of Week 2 concepts
+- **8-9 correct**: Very good! Review the topics you missed
+- **6-7 correct**: Good start. Go back and review the key concepts
+- **5 or fewer**: Review the Week 2 material again and try the practice exercises
+
+---
+
+## Topics Covered
+
+This quiz tests your understanding of:
+- Live hacking and its real-world applications
+- GDB connection and debug session setup
+- Flash vs SRAM memory properties (read-only vs read-write)
+- Why bare-metal systems lack `malloc()`
+- Writing data directly to SRAM with GDB
+- ARM calling convention and register `r0`
+- The infinite loop instruction `b.n`
+- Hardware vs software breakpoints
+- Examining memory and strings with GDB
+- The complete attack flow: breakpoint → examine → inject → hijack → continue
@@ -0,0 +1,41 @@
+# Embedded Systems Reverse Engineering
+[Repository](https://github.com/mytechnotalent/Embedded-Hacking)
+
+## Week 2
+Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2
+
+### Non-Credit Practice Exercise 1 Solution: Change the Message
+
+#### Answers
+
+##### Attack Summary
+The goal is to write a custom message into SRAM at `0x20000000` and redirect `r0` to print it instead of the original `"hello, world"` string, without changing the source code.
+
+##### GDB Commands
+
+```gdb
+(gdb) target extended-remote :3333
+(gdb) monitor reset halt
+(gdb) b *0x1000023c                    # Breakpoint before __wrap_puts
+(gdb) c                                 # Continue to breakpoint
+(gdb) set {char[20]} 0x20000000 = {'Y','o','u','r',' ','N','a','m','e','!','\r','\0'}
+(gdb) set $r0 = 0x20000000             # Redirect r0 to injected message
+(gdb) c                                 # Resume - serial shows custom message
+```
+
+##### Verification
+```gdb
+(gdb) x/s 0x20000000                   # Should show your injected message
+(gdb) x/s 0x100019cc                   # Original string still in Flash
+```
+
+#### Reflection Answers
+
+1. **Why does the string have to live in SRAM instead of flash during runtime?**
+   Flash memory is read-only at runtime. The original string at `0x100019cc` cannot be modified. SRAM starting at `0x20000000` is read-write, so that is where we must place our replacement string.
+
+2. **What would happen if you forgot the null terminator in your injected string?**
+   `puts()` reads characters until it encounters `\0`. Without it, `puts()` would continue reading past the intended string, printing garbage characters from adjacent memory until a null byte happens to appear. This could crash the program or leak sensitive data.
+
+3. **How does changing `r0` alter the behavior of `puts()` without touching source code?**
+   In the ARM calling convention, the first function argument is passed in `r0`. When `bl __wrap_puts` executes at `0x1000023c`, it reads the string address from `r0`. By changing `r0` from `0x100019cc` (original Flash string) to `0x20000000` (our SRAM string), we redirect what `puts()` prints.
@@ -0,0 +1,104 @@
+# Embedded Systems Reverse Engineering
+[Repository](https://github.com/mytechnotalent/Embedded-Hacking)
+
+## Week 2
+Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2
+
+### Non-Credit Practice Exercise 1: Change the Message
+
+#### Objective
+Write your own message into SRAM and redirect `r0` so the running program prints it without changing the source code.
+
+#### Prerequisites
+- Raspberry Pi Pico 2 with debug probe connected
+- OpenOCD and `arm-none-eabi-gdb` available in your PATH
+- Serial monitor (PuTTY/minicom/screen) set to 115200 baud
+- `build\0x0001_hello-world.elf` present and flashed to the board
+- Week 2 setup steps (0a–0e) completed: OpenOCD, serial monitor, and GDB ready
+
+#### Task Description
+You will create a custom string in SRAM at `0x20000000`, point `r0` at it just before `puts()` runs, and watch the live output change to your message.
+
+#### Step-by-Step Instructions
+
+##### Step 1: Start OpenOCD
+
+```powershell
+openocd ^
+  -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^
+  -f interface/cmsis-dap.cfg ^
+  -f target/rp2350.cfg ^
+  -c "adapter speed 5000"
+```
+
+##### Step 2: Start the Serial Monitor
+- Open PuTTY (Serial), choose the correct COM port, set speed to `115200`, then click **Open**.
+
+##### Step 3: Launch GDB
+
+```powershell
+arm-none-eabi-gdb build\0x0001_hello-world.elf
+```
+
+##### Step 4: Connect and Halt
+
+```gdb
+(gdb) target extended-remote :3333
+(gdb) monitor reset halt
+```
+
+##### Step 5: Break Before `puts()`
+
+```gdb
+(gdb) b *0x1000023c
+```
+
+##### Step 6: Run to the Breakpoint
+
+```gdb
+(gdb) c
+```
+
+##### Step 7: Inject Your Message into SRAM
+Replace the characters with your name as needed.
+
+```gdb
+(gdb) set {char[20]} 0x20000000 = {'Y','o','u','r',' ','N','a','m','e','!','\r','\0'}
+```
+
+##### Step 8: Point `r0` to Your Message
+
+```gdb
+(gdb) set $r0 = 0x20000000
+```
+
+##### Step 9: Resume and Observe
+
+```gdb
+(gdb) c
+```
+
+Check PuTTY for your custom string replacing "hello, world".
+
+#### Expected Output
+- GDB stops at `0x1000023c` before `__wrap_puts`.
+- `x/s 0x20000000` shows your injected message.
+- PuTTY displays your custom message after you continue execution.
+
+#### Questions for Reflection
+
+###### Question 1: Why does the string have to live in SRAM instead of flash during runtime?
+
+###### Question 2: What would happen if you forgot the null terminator in your injected string?
+
+###### Question 3: How does changing `r0` alter the behavior of `puts()` without touching source code?
+
+#### Tips and Hints
+- Keep your string length within the allocated array (`char[20]`).
+- If you miss the breakpoint, confirm OpenOCD is running and the address matches `Week 2` disassembly.
+- Use `x/s $r0` to confirm the register points to the intended address before continuing.
+
+#### Next Steps
+- Repeat the exercise with different messages to verify repeatability.
+- Try smaller or larger buffers (still within SRAM) to see how size affects safety.
+- Move on to Exercise 2 to practice using alternate SRAM addresses.
@@ -0,0 +1,38 @@
+# Embedded Systems Reverse Engineering
+[Repository](https://github.com/mytechnotalent/Embedded-Hacking)
+
+## Week 2
+Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2
+
+### Non-Credit Practice Exercise 2 Solution: Use a Different SRAM Address
+
+#### Answers
+
+##### Attack Summary
+Write the payload to `0x20001000` instead of `0x20000000` to demonstrate that multiple safe SRAM locations can be used for injection.
+
+##### GDB Commands
+
+```gdb
+(gdb) b *0x1000023c
+(gdb) c
+(gdb) set {char[14]} 0x20001000 = {'h','a','c','k','e','d','!','!','!','\r','\0'}
+(gdb) set $r0 = 0x20001000
+(gdb) c
+```
+
+##### Verification
+```gdb
+(gdb) x/s 0x20001000                   # Shows "hacked!!!\r"
+```
+
+#### Reflection Answers
+
+1. **How can you ensure `0x20001000` does not collide with stack usage?**
+   The stack pointer was observed at `0x20082000` (top of stack) and grows downward. Since `0x20001000` is far below the stack region, there is substantial separation. Use `info registers sp` in GDB to verify the current stack pointer is well above your injection address.
+
+2. **What symptoms would indicate you overwrote an active stack frame?**
+   The program would crash when attempting to return from a function. Symptoms include: unexpected address exceptions, invalid memory access faults, or the program jumping to random addresses. The Link Register return path gets corrupted.
+
+3. **How would you pick a safe SRAM offset in a larger program with dynamic allocations?**
+   Start from the bottom of SRAM (`0x20000000`) for small static payloads, working upward. Check the linker script to understand memory regions. In this simple program with no heap allocations, both `0x20000000` and `0x20001000` are safe. In larger programs, examine the `.bss` and `.data` section boundaries.
@@ -0,0 +1,91 @@
+# Embedded Systems Reverse Engineering
+[Repository](https://github.com/mytechnotalent/Embedded-Hacking)
+
+## Week 2
+Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2
+
+### Non-Credit Practice Exercise 2: Use a Different SRAM Address
+
+#### Objective
+Practice writing to an alternate SRAM location and redirecting `r0` so your message prints from `0x20001000` instead of `0x20000000`.
+
+#### Prerequisites
+- Raspberry Pi Pico 2 with debug probe connected
+- OpenOCD, `arm-none-eabi-gdb`, and a serial monitor ready (Week 2 steps 0a–0e complete)
+- `build\0x0001_hello-world.elf` flashed and running
+- Comfortable setting breakpoints at `0x1000023c`
+
+#### Task Description
+You will inject a short string into `0x20001000`, point `r0` there, and verify the live output changes, demonstrating that any safe SRAM slot can host your payload.
+
+#### Step-by-Step Instructions
+
+##### Step 1: Start OpenOCD
+
+```powershell
+openocd ^
+  -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^
+  -f interface/cmsis-dap.cfg ^
+  -f target/rp2350.cfg ^
+  -c "adapter speed 5000"
+```
+
+##### Step 2: Start the Serial Monitor
+- Open PuTTY (Serial) on the correct COM port at `115200` baud.
+
+##### Step 3: Launch GDB and Halt
+
+```gdb
+(gdb) target extended-remote :3333
+(gdb) monitor reset halt
+```
+
+##### Step 4: Break Before `puts()`
+
+```gdb
+(gdb) b *0x1000023c
+(gdb) c
+```
+
+##### Step 5: Write a Payload at `0x20001000`
+
+```gdb
+(gdb) set {char[14]} 0x20001000 = {'h','a','c','k','e','d','!','!','!','\r','\0'}
+```
+
+##### Step 6: Redirect `r0`
+
+```gdb
+(gdb) set $r0 = 0x20001000
+```
+
+##### Step 7: Continue and Verify
+
+```gdb
+(gdb) c
+```
+
+Check PuTTY for the new output sourced from the alternate address.
+
+#### Expected Output
+- `x/s 0x20001000` shows `"hacked!!!\r"` (or your variant).
+- PuTTY prints the injected message instead of the original string.
+- The program continues looping with your modified output.
+
+#### Questions for Reflection
+
+###### Question 1: How can you ensure `0x20001000` does not collide with stack usage?
+
+###### Question 2: What symptoms would indicate you overwrote an active stack frame?
+
+###### Question 3: How would you pick a safe SRAM offset in a larger program with dynamic allocations?
+
+#### Tips and Hints
+- Keep payloads short; avoid overrunning the allocated bytes.
+- If you see crashes, choose a lower SRAM address away from the stack top (stack grows downward).
+- Use `info registers sp` and compare with your chosen address to gauge separation.
+
+#### Next Steps
+- Try other safe addresses (e.g., `0x20002000`) and verify stability.
+- Map out stack usage by stepping deeper and watching `sp` move.
+- Proceed to Exercise 3 to inspect memory around your payload.
@@ -0,0 +1,54 @@
+# Embedded Systems Reverse Engineering
+[Repository](https://github.com/mytechnotalent/Embedded-Hacking)
+
+## Week 2
+Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2
+
+### Non-Credit Practice Exercise 3 Solution: Examine Memory Around Your String
+
+#### Answers
+
+##### GDB Commands
+
+```gdb
+(gdb) set {char[14]} 0x20000000 = {'h','a','c','k','y',',',' ','w','o','r','l','d','\r','\0'}
+(gdb) x/20b 0x20000000
+```
+
+##### Byte Dump Output
+
+```
+0x20000000: 0x68 0x61 0x63 0x6b 0x79 0x2c 0x20 0x77
+0x20000008: 0x6f 0x72 0x6c 0x64 0x0d 0x00 0x00 0x00
+0x20000010: 0x00 0x00 0x00 0x00
+```
+
+##### ASCII Mapping
+
+| Offset | Hex Value | Character |
+|--------|-----------|-----------|
+| 0x00 | `0x68` | h |
+| 0x01 | `0x61` | a |
+| 0x02 | `0x63` | c |
+| 0x03 | `0x6b` | k |
+| 0x04 | `0x79` | y |
+| 0x05 | `0x2c` | , (comma) |
+| 0x06 | `0x20` | (space) |
+| 0x07 | `0x77` | w |
+| 0x08 | `0x6f` | o |
+| 0x09 | `0x72` | r |
+| 0x0a | `0x6c` | l |
+| 0x0b | `0x64` | d |
+| 0x0c | `0x0d` | \r (carriage return) |
+| 0x0d | `0x00` | \0 (null terminator) |
+
+#### Reflection Answers
+
+1. **Which bytes mark the end of the printable string, and why are they needed?**
+   The last two meaningful bytes are `0x0d` (carriage return `\r`) and `0x00` (null terminator `\0`). The null terminator signals the end of the string to `puts()`. Without it, `puts()` would read past the intended string and print garbage memory until a null byte is encountered.
+
+2. **How would misaligned writes show up in the byte view?**
+   If you write to an incorrect address or use wrong character offsets, the byte dump would show unexpected values at wrong positions. Characters would appear shifted, and adjacent data structures could be corrupted.
+
+3. **What risks arise if you overwrite bytes immediately after your string?**
+   Overwriting adjacent bytes could corrupt other data structures in SRAM, such as variables, linked lists, or runtime metadata. This could cause unpredictable crashes or silent data corruption depending on what occupies those memory locations.
@@ -0,0 +1,82 @@
+# Embedded Systems Reverse Engineering
+[Repository](https://github.com/mytechnotalent/Embedded-Hacking)
+
+## Week 2
+Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2
+
+### Non-Credit Practice Exercise 3: Examine Memory Around Your String
+
+#### Objective
+Inspect the byte-level layout of your injected string in SRAM and correlate bytes to characters.
+
+#### Prerequisites
+- Pico 2 connected with OpenOCD, GDB, and a serial monitor ready
+- `build\0x0001_hello-world.elf` flashed and running
+- Ability to break before `__wrap_puts` at `0x1000023c`
+- A payload already written to SRAM (e.g., at `0x20000000` from Exercise 1)
+
+#### Task Description
+You will use `x/20b` to view the bytes surrounding your injected string, decode the characters, and confirm the presence of control characters and the null terminator.
+
+#### Step-by-Step Instructions
+
+##### Step 1: Connect and Halt
+
+```gdb
+(gdb) target extended-remote :3333
+(gdb) monitor reset halt
+```
+
+##### Step 2: Break Before `puts()` and Run
+
+```gdb
+(gdb) b *0x1000023c
+(gdb) c
+```
+
+##### Step 3: Ensure a String Exists in SRAM
+If needed, re-inject a payload:
+
+```gdb
+(gdb) set {char[14]} 0x20000000 = {'h','a','c','k','y',',',' ','w','o','r','l','d','\r','\0'}
+(gdb) set $r0 = 0x20000000
+```
+
+##### Step 4: Examine Bytes Around the String
+
+```gdb
+(gdb) x/20b 0x20000000
+```
+
+##### Step 5: Decode the Output
+- Map each byte to ASCII: e.g., `0x68` ? `h`, `0x0d` ? `\r`, `0x00` ? `\0`.
+- Note any bytes before/after the string to ensure you did not overwrite adjacent data.
+
+##### Step 6: Resume Execution
+
+```gdb
+(gdb) c
+```
+
+#### Expected Output
+- A byte dump where the sequence matches your string (`68 61 63 6b 79 2c 20 77 6f 72 6c 64 0d 00`).
+- Confirmation of the carriage return (`0x0d`) and null terminator (`0x00`).
+- Stable program output in PuTTY after resuming.
+
+#### Questions for Reflection
+
+###### Question 1: Which bytes mark the end of the printable string, and why are they needed?
+
+###### Question 2: How would misaligned writes show up in the byte view?
+
+###### Question 3: What risks arise if you overwrite bytes immediately after your string?
+
+#### Tips and Hints
+- Use `x/20bx` if you prefer hex with ASCII side-by-side.
+- Keep the dump length modest (20 bytes) to avoid clutter while still seeing context.
+- If the bytes look incorrect, re-run the injection command to reset the buffer.
+
+#### Next Steps
+- Try viewing a different address (e.g., `0x20001000`) to compare layouts.
+- Experiment with longer strings and observe how the byte dump grows.
+- Move on to Exercise 4 to automate the hack workflow.
@@ -0,0 +1,58 @@
+# Embedded Systems Reverse Engineering
+[Repository](https://github.com/mytechnotalent/Embedded-Hacking)
+
+## Week 2
+Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2
+
+### Non-Credit Practice Exercise 4 Solution: Automate the Hack
+
+#### Answers
+
+##### GDB Command Definition
+
+```gdb
+(gdb) define hack
+> set {char[14]} 0x20000000 = {'h','a','c','k','y',',',' ','w','o','r','l','d','\r','\0'}
+> set $r0 = 0x20000000
+> c
+> end
+```
+
+##### Usage
+
+```gdb
+(gdb) b *0x1000023c
+(gdb) c
+(gdb) hack                             # Executes all three commands at once
+```
+
+##### Expected Serial Output
+
+```
+hello, world
+hello, world
+hello, world
+hacky, world     <-- HACKED! (after hack command executed)
+hacky, world
+```
+
+#### Reflection Answers
+
+1. **How could you parameterize the command to accept different strings or addresses?**
+   Standard GDB `define` blocks do not support function parameters directly. However, you can use GDB convenience variables (`set $myaddr = 0x20000000`) and reference them in the macro, or create multiple specific commands like `hack_addr1`, `hack_addr2`. For advanced parameterization, use GDB Python scripting.
+
+2. **What happens if you define `hack` before setting the breakpoint - will it still work as expected?**
+   The `define` command only creates a macro; it does not execute immediately. The breakpoint must be set and hit before invoking `hack`. The sequence matters: set breakpoint -> run/continue to hit breakpoint -> then call `hack`. Defining the macro before or after the breakpoint does not matter as long as you invoke it at the right time.
+
+3. **How would you adapt this pattern for multi-step routines (e.g., patch, dump, continue)?**
+   Extend the `define` block with additional commands:
+   ```gdb
+   (gdb) define hack_verbose
+   > set {char[14]} 0x20000000 = {'h','a','c','k','y',',',' ','w','o','r','l','d','\r','\0'}
+   > x/20b 0x20000000
+   > set $r0 = 0x20000000
+   > info registers r0
+   > c
+   > end
+   ```
+   This dumps memory and registers before continuing, providing verification at each step.
@@ -0,0 +1,71 @@
+# Embedded Systems Reverse Engineering
+[Repository](https://github.com/mytechnotalent/Embedded-Hacking)
+
+## Week 2
+Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2
+
+### Non-Credit Practice Exercise 4: Automate the Hack
+
+#### Objective
+Create a reusable GDB command that injects a string into SRAM, repoints `r0`, and resumes execution with a single call.
+
+#### Prerequisites
+- Pico 2 connected with OpenOCD, GDB, and serial monitor ready
+- `build\0x0001_hello-world.elf` available
+- Familiarity with breaking at `0x1000023c` and injecting strings from prior exercises
+
+#### Task Description
+You will define a custom GDB command `hack` that writes a payload to `0x20000000`, repoints `r0`, and continues execution automatically.
+
+#### Step-by-Step Instructions
+
+##### Step 1: Connect, Halt, and Break
+
+```gdb
+(gdb) target extended-remote :3333
+(gdb) monitor reset halt
+(gdb) b *0x1000023c
+(gdb) c
+```
+
+##### Step 2: Define the `hack` Command
+
+```gdb
+(gdb) define hack
+> set {char[14]} 0x20000000 = {'h','a','c','k','y',',',' ','w','o','r','l','d','\r','\0'}
+> set $r0 = 0x20000000
+> c
+> end
+```
+
+##### Step 3: Invoke the Command
+
+```gdb
+(gdb) hack
+```
+
+##### Step 4: Observe Output
+- PuTTY should immediately show your injected string after the command runs.
+- The breakpoint will be re-hit on the next loop iteration; rerun `hack` if you want to reapply after changes.
+
+#### Expected Output
+- `hack` executes without errors, writes the payload, updates `r0`, and resumes execution.
+- Serial output reflects the injected message.
+
+#### Questions for Reflection
+
+###### Question 1: How could you parameterize the command to accept different strings or addresses?
+
+###### Question 2: What happens if you define `hack` before setting the breakpoint—will it still work as expected?
+
+###### Question 3: How would you adapt this pattern for multi-step routines (e.g., patch, dump, continue)?
+
+#### Tips and Hints
+- Redefine `hack` any time you want a different payload; GDB will overwrite the prior definition.
+- Keep the payload length aligned with the buffer size to avoid stray bytes.
+- If the target keeps running past the breakpoint, ensure hardware breakpoints are available and set correctly.
+
+#### Next Steps
+- Create additional helper commands (e.g., `dumpstr`, `retarget`) to streamline experiments.
+- Explore GDB scripting files (`.gdbinit`) to auto-load your helpers on startup.
+- Try combining `hack` with watchpoints to observe memory changes live.
@@ -0,0 +1,79 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800">
+<style>
+  .bg{fill:#0a0a0f}.pnl{fill:#12121a;stroke:#1a1a2e}.hdr{fill:#12121a}
+  .title{font:bold 42px 'Courier New',monospace;fill:#00ff41}
+  .sub{font:bold 28px 'Courier New',monospace;fill:#00d4ff}
+  .txt{font:24px 'Courier New',monospace;fill:#c0c0c0}
+  .dim{font:20px 'Courier New',monospace;fill:#888}
+  .grn{font:bold 24px 'Courier New',monospace;fill:#00ff41}
+  .red{font:bold 24px 'Courier New',monospace;fill:#ff0040}
+  .cyn{font:bold 24px 'Courier New',monospace;fill:#00d4ff}
+  .amb{font:bold 24px 'Courier New',monospace;fill:#ffaa00}
+  .badge{stroke:#00ff41;rx:14}
+</style>
+<rect class="bg" width="1200" height="800"/>
+
+<!-- Background grid decoration -->
+<g opacity="0.06">
+  <line x1="0" y1="100" x2="1200" y2="100" stroke="#00ff41" stroke-width="1"/>
+  <line x1="0" y1="200" x2="1200" y2="200" stroke="#00ff41" stroke-width="1"/>
+  <line x1="0" y1="300" x2="1200" y2="300" stroke="#00ff41" stroke-width="1"/>
+  <line x1="0" y1="400" x2="1200" y2="400" stroke="#00ff41" stroke-width="1"/>
+  <line x1="0" y1="500" x2="1200" y2="500" stroke="#00ff41" stroke-width="1"/>
+  <line x1="0" y1="600" x2="1200" y2="600" stroke="#00ff41" stroke-width="1"/>
+  <line x1="0" y1="700" x2="1200" y2="700" stroke="#00ff41" stroke-width="1"/>
+  <line x1="200" y1="0" x2="200" y2="800" stroke="#00ff41" stroke-width="1"/>
+  <line x1="400" y1="0" x2="400" y2="800" stroke="#00ff41" stroke-width="1"/>
+  <line x1="600" y1="0" x2="600" y2="800" stroke="#00ff41" stroke-width="1"/>
+  <line x1="800" y1="0" x2="800" y2="800" stroke="#00ff41" stroke-width="1"/>
+  <line x1="1000" y1="0" x2="1000" y2="800" stroke="#00ff41" stroke-width="1"/>
+</g>
+
+<!-- Hex rain decoration -->
+<g opacity="0.04" font-family="'Courier New',monospace" font-size="14" fill="#00ff41">
+  <text x="50" y="80">4F 70 65 6E 4F 43 44</text>
+  <text x="900" y="120">10 00 02 34 08 B5 01</text>
+  <text x="150" y="180">47 44 42 20 52 45 56</text>
+  <text x="800" y="240">20 08 20 00 FF AA 00</text>
+  <text x="80" y="350">52 50 32 33 35 30 00</text>
+  <text x="950" y="380">0A 0A 0F 12 12 1A 1A</text>
+  <text x="100" y="520">41 52 4D 76 38 2D 4D</text>
+  <text x="870" y="560">00 FF 41 00 D4 FF 88</text>
+  <text x="60" y="680">47 48 49 44 52 41 00</text>
+  <text x="920" y="720">FF 00 40 C0 C0 C0 00</text>
+</g>
+
+<!-- Corner accents -->
+<polyline points="30,30 30,80 80,80" fill="none" stroke="#00ff41" stroke-width="2" opacity="0.3"/>
+<polyline points="1170,30 1170,80 1120,80" fill="none" stroke="#00ff41" stroke-width="2" opacity="0.3"/>
+<polyline points="30,770 30,720 80,720" fill="none" stroke="#00ff41" stroke-width="2" opacity="0.3"/>
+<polyline points="1170,770 1170,720 1120,720" fill="none" stroke="#00ff41" stroke-width="2" opacity="0.3"/>
+
+<!-- Top accent line -->
+<rect x="100" y="140" width="1000" height="2" fill="#00ff41" opacity="0.4"/>
+
+<!-- Course Title -->
+<text x="600" y="210" text-anchor="middle" font-family="'Courier New',monospace" font-size="56" font-weight="bold" fill="#00ff41">Embedded Systems</text>
+<text x="600" y="278" text-anchor="middle" font-family="'Courier New',monospace" font-size="56" font-weight="bold" fill="#00ff41">Reverse Engineering</text>
+
+<!-- Divider -->
+<rect x="300" y="310" width="600" height="2" fill="#00d4ff" opacity="0.6"/>
+
+<!-- Week Number -->
+<text x="600" y="380" text-anchor="middle" font-family="'Courier New',monospace" font-size="42" font-weight="bold" fill="#00d4ff">// WEEK 02</text>
+
+<!-- Week Topic -->
+<text x="600" y="440" text-anchor="middle" font-family="'Courier New',monospace" font-size="28" fill="#c0c0c0">Hello, World - Debugging and</text>
+<text x="600" y="478" text-anchor="middle" font-family="'Courier New',monospace" font-size="28" fill="#c0c0c0">Hacking Basics: Debugging and Hacking</text>
+<text x="600" y="516" text-anchor="middle" font-family="'Courier New',monospace" font-size="28" fill="#c0c0c0">a Basic Program for the Pico 2</text>
+
+<!-- Bottom accent line -->
+<rect x="100" y="570" width="1000" height="2" fill="#00ff41" opacity="0.4"/>
+
+<!-- University -->
+<text x="600" y="635" text-anchor="middle" font-family="'Courier New',monospace" font-size="36" font-weight="bold" fill="#ffaa00">George Mason University</text>
+
+<!-- Bottom badge -->
+<rect x="400" y="670" width="400" height="40" rx="20" fill="none" stroke="#00ff41" stroke-width="1.5" opacity="0.5"/>
+<text x="600" y="697" text-anchor="middle" font-family="'Courier New',monospace" font-size="20" fill="#00ff41" opacity="0.7">RP2350 // ARM Cortex-M33</text>
+</svg>
@@ -0,0 +1,73 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800">
+<style>
+  .bg{fill:#0a0a0f}.pnl{fill:#12121a;stroke:#1a1a2e}.hdr{fill:#12121a}
+  .title{font:bold 42px 'Courier New',monospace;fill:#00ff41}
+  .sub{font:bold 28px 'Courier New',monospace;fill:#00d4ff}
+  .txt{font:24px 'Courier New',monospace;fill:#c0c0c0}
+  .dim{font:20px 'Courier New',monospace;fill:#888}
+  .grn{font:bold 24px 'Courier New',monospace;fill:#00ff41}
+  .red{font:bold 24px 'Courier New',monospace;fill:#ff0040}
+  .cyn{font:bold 24px 'Courier New',monospace;fill:#00d4ff}
+  .amb{font:bold 24px 'Courier New',monospace;fill:#ffaa00}
+  .badge{stroke:#00ff41;rx:14}
+</style>
+<rect class="bg" width="1200" height="800"/>
+
+<!-- Title -->
+<text x="600" y="52" text-anchor="middle" class="title">Live Hacking Overview</text>
+<text x="600" y="88" text-anchor="middle" class="dim">Introduction to Live Hacking</text>
+
+  <!-- Left Panel: What is live hacking -->
+  <rect x="30" y="105" width="540" height="675" class="pnl" rx="8"/>
+  <text x="300" y="148" text-anchor="middle" class="sub">What Is Live Hacking?</text>
+  <line x1="50" y1="163" x2="550" y2="163" stroke="#1a1a2e"/>
+
+  <text x="55" y="205" class="txt">Modify a program</text>
+  <text x="55" y="237" class="txt">WHILE it is running</text>
+  <text x="55" y="269" class="txt">on real hardware</text>
+
+  <line x1="50" y1="297" x2="550" y2="297" stroke="#1a1a2e"/>
+
+  <text x="55" y="337" class="amb">The Train Analogy</text>
+  <text x="55" y="372" class="txt">Train heading to NYC</text>
+  <text x="55" y="404" class="txt">Switch the tracks</text>
+  <text x="55" y="436" class="txt">while it moves</text>
+  <text x="55" y="468" class="red">Now it goes to LA!</text>
+
+  <line x1="50" y1="496" x2="550" y2="496" stroke="#1a1a2e"/>
+
+  <text x="55" y="536" class="cyn">Why It Matters</text>
+  <text x="55" y="571" class="txt">Security research</text>
+  <text x="55" y="603" class="txt">Penetration testing</text>
+  <text x="55" y="635" class="txt">Malware analysis</text>
+  <text x="55" y="667" class="txt">Hardware debugging</text>
+
+  <text x="300" y="740" text-anchor="middle" class="dim">No recompile needed!</text>
+
+  <!-- Right Panel: This Week's Goal -->
+  <rect x="600" y="105" width="570" height="675" class="pnl" rx="8"/>
+  <text x="885" y="148" text-anchor="middle" class="sub">This Week's Goal</text>
+  <line x1="620" y1="163" x2="1150" y2="163" stroke="#1a1a2e"/>
+
+  <text x="625" y="205" class="grn">Target Program</text>
+  <text x="625" y="240" class="txt">hello-world.c</text>
+  <text x="625" y="272" class="txt">Prints "hello, world"</text>
+  <text x="625" y="304" class="txt">in infinite loop</text>
+
+  <line x1="620" y1="332" x2="1150" y2="332" stroke="#1a1a2e"/>
+
+  <text x="625" y="372" class="red">Our Mission</text>
+  <text x="625" y="407" class="txt">Make it print</text>
+  <text x="625" y="439" class="txt">something ELSE</text>
+  <text x="625" y="471" class="txt">without changing</text>
+  <text x="625" y="503" class="txt">the source code</text>
+
+  <line x1="620" y1="531" x2="1150" y2="531" stroke="#1a1a2e"/>
+
+  <text x="625" y="571" class="amb">Tools Used</text>
+  <text x="625" y="606" class="txt">GDB  = live debug</text>
+  <text x="625" y="638" class="txt">OpenOCD = HW bridge</text>
+  <text x="625" y="670" class="txt">Ghidra = analysis</text>
+
+  <text x="885" y="745" text-anchor="middle" class="dim">Hack the running binary</text>
+</svg>
@@ -0,0 +1,80 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800">
+<style>
+  .bg{fill:#0a0a0f}.pnl{fill:#12121a;stroke:#1a1a2e}.hdr{fill:#12121a}
+  .title{font:bold 42px 'Courier New',monospace;fill:#00ff41}
+  .sub{font:bold 28px 'Courier New',monospace;fill:#00d4ff}
+  .txt{font:24px 'Courier New',monospace;fill:#c0c0c0}
+  .dim{font:20px 'Courier New',monospace;fill:#888}
+  .grn{font:bold 24px 'Courier New',monospace;fill:#00ff41}
+  .red{font:bold 24px 'Courier New',monospace;fill:#ff0040}
+  .cyn{font:bold 24px 'Courier New',monospace;fill:#00d4ff}
+  .amb{font:bold 24px 'Courier New',monospace;fill:#ffaa00}
+  .badge{stroke:#00ff41;rx:14}
+</style>
+<rect class="bg" width="1200" height="800"/>
+
+<!-- Title -->
+<text x="600" y="52" text-anchor="middle" class="title">GDB Debug Session</text>
+<text x="600" y="88" text-anchor="middle" class="dim">GDB Fundamentals</text>
+
+  <!-- Left Panel: Connection Steps -->
+  <rect x="30" y="105" width="540" height="675" class="pnl" rx="8"/>
+  <text x="300" y="148" text-anchor="middle" class="sub">Setup Steps</text>
+  <line x1="50" y1="163" x2="550" y2="163" stroke="#1a1a2e"/>
+
+  <!-- Step 1 -->
+  <text x="55" y="205" class="dim">Step 1: Start OpenOCD</text>
+  <rect x="55" y="220" width="490" height="50" rx="5" fill="#0f0f1a" stroke="#00d4ff" stroke-width="2"/>
+  <text x="300" y="252" text-anchor="middle" class="cyn">openocd -f rp2350.cfg</text>
+
+  <!-- Step 2 -->
+  <text x="55" y="310" class="dim">Step 2: Launch GDB</text>
+  <rect x="55" y="325" width="490" height="50" rx="5" fill="#0f1a0f" stroke="#00ff41" stroke-width="2"/>
+  <text x="300" y="357" text-anchor="middle" class="grn">gdb-multiarch hello.elf</text>
+
+  <!-- Step 3 -->
+  <text x="55" y="415" class="dim">Step 3: Connect to target</text>
+  <rect x="55" y="430" width="490" height="50" rx="5" fill="#1a1a0f" stroke="#ffaa00" stroke-width="2"/>
+  <text x="300" y="462" text-anchor="middle" class="amb">target remote :3333</text>
+
+  <!-- Step 4 -->
+  <text x="55" y="520" class="dim">Step 4: Reset + halt</text>
+  <rect x="55" y="535" width="490" height="50" rx="5" fill="#1a0f0f" stroke="#ff0040" stroke-width="2"/>
+  <text x="300" y="567" text-anchor="middle" class="red">monitor reset halt</text>
+
+  <!-- Step 5 -->
+  <text x="55" y="625" class="dim">Step 5: Set breakpoint</text>
+  <rect x="55" y="640" width="490" height="50" rx="5" fill="#0f1a0f" stroke="#00ff41" stroke-width="2"/>
+  <text x="300" y="672" text-anchor="middle" class="grn">break main</text>
+
+  <text x="300" y="735" text-anchor="middle" class="dim">Then: continue (c)</text>
+
+  <!-- Right Panel: What Each Does -->
+  <rect x="600" y="105" width="570" height="675" class="pnl" rx="8"/>
+  <text x="885" y="148" text-anchor="middle" class="sub">What Each Does</text>
+  <line x1="620" y1="163" x2="1150" y2="163" stroke="#1a1a2e"/>
+
+  <text x="625" y="205" class="cyn">openocd</text>
+  <text x="625" y="240" class="txt">Bridges USB probe</text>
+  <text x="625" y="272" class="txt">to GDB via TCP</text>
+  <text x="625" y="304" class="dim">Listens on port 3333</text>
+
+  <line x1="620" y1="337" x2="1150" y2="337" stroke="#1a1a2e"/>
+
+  <text x="625" y="377" class="grn">gdb-multiarch</text>
+  <text x="625" y="412" class="txt">ARM-aware debugger</text>
+  <text x="625" y="444" class="txt">Loads ELF symbols</text>
+
+  <line x1="620" y1="472" x2="1150" y2="472" stroke="#1a1a2e"/>
+
+  <text x="625" y="512" class="amb">target remote</text>
+  <text x="625" y="547" class="txt">GDB connects to</text>
+  <text x="625" y="579" class="txt">OpenOCD server</text>
+
+  <line x1="620" y1="607" x2="1150" y2="607" stroke="#1a1a2e"/>
+
+  <text x="625" y="647" class="red">monitor reset halt</text>
+  <text x="625" y="682" class="txt">Reset chip + stop</text>
+  <text x="625" y="714" class="txt">at very first instr</text>
+  <text x="625" y="746" class="dim">Clean starting state</text>
+</svg>
@@ -0,0 +1,88 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800">
+<style>
+  .bg{fill:#0a0a0f}.pnl{fill:#12121a;stroke:#1a1a2e}.hdr{fill:#12121a}
+  .title{font:bold 42px 'Courier New',monospace;fill:#00ff41}
+  .sub{font:bold 28px 'Courier New',monospace;fill:#00d4ff}
+  .txt{font:24px 'Courier New',monospace;fill:#c0c0c0}
+  .dim{font:20px 'Courier New',monospace;fill:#888}
+  .grn{font:bold 24px 'Courier New',monospace;fill:#00ff41}
+  .red{font:bold 24px 'Courier New',monospace;fill:#ff0040}
+  .cyn{font:bold 24px 'Courier New',monospace;fill:#00d4ff}
+  .amb{font:bold 24px 'Courier New',monospace;fill:#ffaa00}
+  .badge{stroke:#00ff41;rx:14}
+</style>
+<rect class="bg" width="1200" height="800"/>
+
+<!-- Title -->
+<text x="600" y="52" text-anchor="middle" class="title">Breakpoints</text>
+<text x="600" y="88" text-anchor="middle" class="dim">GDB Breakpoint Types</text>
+
+  <!-- Left Panel: How Breakpoints Work -->
+  <rect x="30" y="105" width="540" height="675" class="pnl" rx="8"/>
+  <text x="300" y="148" text-anchor="middle" class="sub">How They Work</text>
+  <line x1="50" y1="163" x2="550" y2="163" stroke="#1a1a2e"/>
+
+  <!-- Normal execution -->
+  <text x="55" y="203" class="grn">Normal Execution</text>
+
+  <rect x="55" y="220" width="490" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="70" y="248" class="txt">MOV r0, #5</text>
+
+  <rect x="55" y="272" width="490" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="70" y="300" class="txt">MOV r1, #3</text>
+
+  <rect x="55" y="324" width="490" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="70" y="352" class="txt">BL printf</text>
+
+  <!-- Breakpoint set -->
+  <text x="55" y="410" class="red">With Breakpoint</text>
+
+  <rect x="55" y="427" width="490" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="70" y="455" class="txt">MOV r0, #5</text>
+
+  <rect x="55" y="479" width="490" height="42" rx="4" fill="#1a0f0f" stroke="#ff0040" stroke-width="2"/>
+  <text x="70" y="507" class="red">MOV r1, #3</text>
+  <text x="520" y="507" text-anchor="end" class="red">STOP</text>
+
+  <rect x="55" y="531" width="490" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e" stroke-dasharray="6"/>
+  <text x="70" y="559" class="dim">BL printf</text>
+  <text x="520" y="559" text-anchor="end" class="dim">paused</text>
+
+  <text x="300" y="620" text-anchor="middle" class="txt">CPU halts BEFORE</text>
+  <text x="300" y="652" text-anchor="middle" class="txt">executing breakpoint</text>
+  <text x="300" y="684" text-anchor="middle" class="txt">instruction</text>
+
+  <text x="300" y="740" text-anchor="middle" class="dim">Now you can inspect</text>
+
+  <!-- Right Panel: GDB Commands -->
+  <rect x="600" y="105" width="570" height="675" class="pnl" rx="8"/>
+  <text x="885" y="148" text-anchor="middle" class="sub">GDB Breakpoints</text>
+  <line x1="620" y1="163" x2="1150" y2="163" stroke="#1a1a2e"/>
+
+  <text x="625" y="205" class="grn">break main</text>
+  <text x="625" y="240" class="txt">Stop at function</text>
+  <text x="625" y="272" class="dim">By symbol name</text>
+
+  <line x1="620" y1="300" x2="1150" y2="300" stroke="#1a1a2e"/>
+
+  <text x="625" y="340" class="grn">break *0x10000340</text>
+  <text x="625" y="375" class="txt">Stop at exact addr</text>
+  <text x="625" y="407" class="dim">By hex address</text>
+
+  <line x1="620" y1="435" x2="1150" y2="435" stroke="#1a1a2e"/>
+
+  <text x="625" y="475" class="cyn">info break</text>
+  <text x="625" y="510" class="txt">List all active</text>
+  <text x="625" y="542" class="txt">breakpoints</text>
+
+  <line x1="620" y1="570" x2="1150" y2="570" stroke="#1a1a2e"/>
+
+  <text x="625" y="610" class="amb">continue (c)</text>
+  <text x="625" y="645" class="txt">Resume running</text>
+  <text x="625" y="677" class="txt">until next break</text>
+
+  <line x1="620" y1="705" x2="1150" y2="705" stroke="#1a1a2e"/>
+
+  <text x="625" y="745" class="red">delete 1</text>
+  <text x="625" y="777" class="dim">Remove breakpoint #1</text>
+</svg>
@@ -0,0 +1,101 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800">
+<style>
+  .bg{fill:#0a0a0f}.pnl{fill:#12121a;stroke:#1a1a2e}.hdr{fill:#12121a}
+  .title{font:bold 42px 'Courier New',monospace;fill:#00ff41}
+  .sub{font:bold 28px 'Courier New',monospace;fill:#00d4ff}
+  .txt{font:24px 'Courier New',monospace;fill:#c0c0c0}
+  .dim{font:20px 'Courier New',monospace;fill:#888}
+  .grn{font:bold 24px 'Courier New',monospace;fill:#00ff41}
+  .red{font:bold 24px 'Courier New',monospace;fill:#ff0040}
+  .cyn{font:bold 24px 'Courier New',monospace;fill:#00d4ff}
+  .amb{font:bold 24px 'Courier New',monospace;fill:#ffaa00}
+  .badge{stroke:#00ff41;rx:14}
+</style>
+<rect class="bg" width="1200" height="800"/>
+
+<!-- Title -->
+<text x="600" y="52" text-anchor="middle" class="title">Stack in Action</text>
+<text x="600" y="88" text-anchor="middle" class="dim">Runtime Stack Analysis</text>
+
+  <!-- Left Panel: Before PUSH -->
+  <rect x="30" y="105" width="350" height="675" class="pnl" rx="8"/>
+  <text x="205" y="148" text-anchor="middle" class="sub">Before Call</text>
+  <line x1="50" y1="163" x2="360" y2="163" stroke="#1a1a2e"/>
+
+  <text x="55" y="200" class="dim">SP = 0x20082000</text>
+
+  <rect x="55" y="220" width="290" height="50" rx="4" fill="#0a0a0f" stroke="#1a1a2e" stroke-dasharray="6"/>
+  <text x="200" y="252" text-anchor="middle" class="dim">(empty)</text>
+
+  <rect x="55" y="280" width="290" height="50" rx="4" fill="#0a0a0f" stroke="#1a1a2e" stroke-dasharray="6"/>
+  <text x="200" y="312" text-anchor="middle" class="dim">(empty)</text>
+
+  <rect x="55" y="340" width="290" height="50" rx="4" fill="#0a0a0f" stroke="#1a1a2e" stroke-dasharray="6"/>
+  <text x="200" y="372" text-anchor="middle" class="dim">(empty)</text>
+
+  <rect x="55" y="400" width="290" height="50" rx="4" fill="#0a0a0f" stroke="#1a1a2e" stroke-dasharray="6"/>
+  <text x="200" y="432" text-anchor="middle" class="dim">(empty)</text>
+
+  <text x="205" y="510" text-anchor="middle" class="txt">Stack is clean</text>
+  <text x="205" y="542" text-anchor="middle" class="txt">SP at top of</text>
+  <text x="205" y="574" text-anchor="middle" class="txt">SRAM space</text>
+
+  <text x="205" y="650" text-anchor="middle" class="grn">Ready to call</text>
+  <text x="205" y="682" text-anchor="middle" class="grn">main()</text>
+
+  <!-- Middle Panel: After PUSH {r4, lr} -->
+  <rect x="410" y="105" width="370" height="675" class="pnl" rx="8"/>
+  <text x="595" y="148" text-anchor="middle" class="sub">After PUSH</text>
+  <line x1="430" y1="163" x2="760" y2="163" stroke="#1a1a2e"/>
+
+  <text x="435" y="200" class="dim">PUSH {r4, lr}</text>
+
+  <rect x="435" y="220" width="310" height="50" rx="4" fill="#0a0a0f" stroke="#1a1a2e" stroke-dasharray="6"/>
+  <text x="590" y="252" text-anchor="middle" class="dim">(empty)</text>
+
+  <rect x="435" y="280" width="310" height="50" rx="4" fill="#0a0a0f" stroke="#1a1a2e" stroke-dasharray="6"/>
+  <text x="590" y="312" text-anchor="middle" class="dim">(empty)</text>
+
+  <rect x="435" y="340" width="310" height="50" rx="4" fill="#1a0f0f" stroke="#ff0040" stroke-width="2"/>
+  <text x="590" y="372" text-anchor="middle" class="red">LR saved</text>
+
+  <rect x="435" y="400" width="310" height="50" rx="4" fill="#1a1a0f" stroke="#ffaa00" stroke-width="2"/>
+  <text x="590" y="432" text-anchor="middle" class="amb">r4 saved</text>
+
+  <text x="595" y="500" text-anchor="middle" class="red">SP moved down</text>
+  <text x="595" y="535" text-anchor="middle" class="txt">by 8 bytes</text>
+  <text x="595" y="567" text-anchor="middle" class="dim">2 regs x 4 bytes</text>
+
+  <text x="595" y="650" text-anchor="middle" class="cyn">GDB: info regs</text>
+  <text x="595" y="685" text-anchor="middle" class="dim">Watch SP change!</text>
+
+  <!-- Right Panel: Key Points -->
+  <rect x="810" y="105" width="360" height="675" class="pnl" rx="8"/>
+  <text x="990" y="148" text-anchor="middle" class="sub">Key Points</text>
+  <line x1="830" y1="163" x2="1150" y2="163" stroke="#1a1a2e"/>
+
+  <text x="835" y="205" class="grn">PUSH saves</text>
+  <text x="835" y="240" class="txt">Preserves regs</text>
+  <text x="835" y="272" class="txt">before function</text>
+  <text x="835" y="304" class="txt">body runs</text>
+
+  <line x1="830" y1="332" x2="1150" y2="332" stroke="#1a1a2e"/>
+
+  <text x="835" y="372" class="red">POP restores</text>
+  <text x="835" y="407" class="txt">Puts values</text>
+  <text x="835" y="439" class="txt">back when func</text>
+  <text x="835" y="471" class="txt">returns</text>
+
+  <line x1="830" y1="499" x2="1150" y2="499" stroke="#1a1a2e"/>
+
+  <text x="835" y="539" class="amb">Watch in GDB</text>
+  <text x="835" y="574" class="txt">x/4xw $sp</text>
+  <text x="835" y="606" class="dim">See stack data</text>
+
+  <line x1="830" y1="634" x2="1150" y2="634" stroke="#1a1a2e"/>
+
+  <text x="835" y="674" class="cyn">stepi</text>
+  <text x="835" y="709" class="txt">Step 1 instr</text>
+  <text x="835" y="741" class="txt">watch stack</text>
+  <text x="835" y="773" class="dim">change live</text>
+</svg>
@@ -0,0 +1,79 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800">
+<style>
+  .bg{fill:#0a0a0f}.pnl{fill:#12121a;stroke:#1a1a2e}.hdr{fill:#12121a}
+  .title{font:bold 42px 'Courier New',monospace;fill:#00ff41}
+  .sub{font:bold 28px 'Courier New',monospace;fill:#00d4ff}
+  .txt{font:24px 'Courier New',monospace;fill:#c0c0c0}
+  .dim{font:20px 'Courier New',monospace;fill:#888}
+  .grn{font:bold 24px 'Courier New',monospace;fill:#00ff41}
+  .red{font:bold 24px 'Courier New',monospace;fill:#ff0040}
+  .cyn{font:bold 24px 'Courier New',monospace;fill:#00d4ff}
+  .amb{font:bold 24px 'Courier New',monospace;fill:#ffaa00}
+  .badge{stroke:#00ff41;rx:14}
+</style>
+<rect class="bg" width="1200" height="800"/>
+
+<!-- Title -->
+<text x="600" y="52" text-anchor="middle" class="title">LDR Instruction</text>
+<text x="600" y="88" text-anchor="middle" class="dim">ARM Load Instructions</text>
+
+  <!-- Left Panel: LDR Flow -->
+  <rect x="30" y="105" width="540" height="675" class="pnl" rx="8"/>
+  <text x="300" y="148" text-anchor="middle" class="sub">How LDR Works</text>
+  <line x1="50" y1="163" x2="550" y2="163" stroke="#1a1a2e"/>
+
+  <!-- The instruction -->
+  <text x="55" y="205" class="dim">Instruction:</text>
+  <rect x="55" y="220" width="490" height="50" rx="5" fill="#0f1a0f" stroke="#00ff41" stroke-width="2"/>
+  <text x="300" y="252" text-anchor="middle" class="grn">LDR r0, [pc, #12]</text>
+
+  <!-- Step 1 -->
+  <text x="55" y="315" class="amb">Step 1: Calculate addr</text>
+  <rect x="55" y="335" width="490" height="50" rx="5" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="300" y="367" text-anchor="middle" class="txt">addr = PC + 12</text>
+
+  <!-- Step 2 -->
+  <text x="55" y="430" class="amb">Step 2: Read memory</text>
+  <rect x="55" y="450" width="490" height="50" rx="5" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="300" y="482" text-anchor="middle" class="txt">value = *(addr)</text>
+
+  <!-- Step 3 -->
+  <text x="55" y="545" class="amb">Step 3: Load into reg</text>
+  <rect x="55" y="565" width="490" height="50" rx="5" fill="#0f0f1a" stroke="#00d4ff" stroke-width="2"/>
+  <text x="300" y="597" text-anchor="middle" class="cyn">r0 = value</text>
+
+  <!-- Result -->
+  <text x="300" y="670" text-anchor="middle" class="txt">r0 now holds the</text>
+  <text x="300" y="702" text-anchor="middle" class="txt">address of our</text>
+  <text x="300" y="734" text-anchor="middle" class="grn">"hello, world" string</text>
+
+  <!-- Right Panel: Why It Matters -->
+  <rect x="600" y="105" width="570" height="675" class="pnl" rx="8"/>
+  <text x="885" y="148" text-anchor="middle" class="sub">Why It Matters</text>
+  <line x1="620" y1="163" x2="1150" y2="163" stroke="#1a1a2e"/>
+
+  <text x="625" y="205" class="grn">String Loading</text>
+  <text x="625" y="240" class="txt">printf needs addr</text>
+  <text x="625" y="272" class="txt">of string in r0</text>
+  <text x="625" y="304" class="dim">r0 = first argument</text>
+
+  <line x1="620" y1="332" x2="1150" y2="332" stroke="#1a1a2e"/>
+
+  <text x="625" y="372" class="cyn">PC-Relative</text>
+  <text x="625" y="407" class="txt">Address computed</text>
+  <text x="625" y="439" class="txt">relative to current</text>
+  <text x="625" y="471" class="txt">PC position</text>
+  <text x="625" y="503" class="dim">Works from any addr</text>
+
+  <line x1="620" y1="531" x2="1150" y2="531" stroke="#1a1a2e"/>
+
+  <text x="625" y="571" class="red">The Attack Point</text>
+  <text x="625" y="606" class="txt">If we change r0</text>
+  <text x="625" y="638" class="txt">AFTER the LDR</text>
+  <text x="625" y="670" class="txt">printf prints OUR</text>
+  <text x="625" y="702" class="txt">string instead!</text>
+
+  <line x1="620" y1="730" x2="1150" y2="730" stroke="#1a1a2e"/>
+
+  <text x="625" y="765" class="amb">This is the hack!</text>
+</svg>
@@ -0,0 +1,93 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800">
+<style>
+  .bg{fill:#0a0a0f}.pnl{fill:#12121a;stroke:#1a1a2e}.hdr{fill:#12121a}
+  .title{font:bold 42px 'Courier New',monospace;fill:#00ff41}
+  .sub{font:bold 28px 'Courier New',monospace;fill:#00d4ff}
+  .txt{font:24px 'Courier New',monospace;fill:#c0c0c0}
+  .dim{font:20px 'Courier New',monospace;fill:#888}
+  .grn{font:bold 24px 'Courier New',monospace;fill:#00ff41}
+  .red{font:bold 24px 'Courier New',monospace;fill:#ff0040}
+  .cyn{font:bold 24px 'Courier New',monospace;fill:#00d4ff}
+  .amb{font:bold 24px 'Courier New',monospace;fill:#ffaa00}
+  .badge{stroke:#00ff41;rx:14}
+</style>
+<rect class="bg" width="1200" height="800"/>
+
+<!-- Title -->
+<text x="600" y="52" text-anchor="middle" class="title">The Attack Plan</text>
+<text x="600" y="88" text-anchor="middle" class="dim">Exploit Strategy</text>
+
+  <!-- Full Width: 4-Step Attack Flow -->
+  <rect x="30" y="105" width="1140" height="280" class="pnl" rx="8"/>
+  <text x="600" y="148" text-anchor="middle" class="sub">Attack Flow (4 Steps)</text>
+  <line x1="50" y1="163" x2="1150" y2="163" stroke="#1a1a2e"/>
+
+  <!-- Step 1 -->
+  <rect x="55" y="185" width="230" height="80" rx="6" fill="#0f0f1a" stroke="#00d4ff" stroke-width="2"/>
+  <text x="170" y="220" text-anchor="middle" class="cyn">1. Break at</text>
+  <text x="170" y="250" text-anchor="middle" class="cyn">printf call</text>
+
+  <!-- Arrow -->
+  <line x1="285" y1="225" x2="330" y2="225" stroke="#888888" stroke-width="3"/>
+  <polygon points="330,215 355,225 330,235" fill="#888888"/>
+
+  <!-- Step 2 -->
+  <rect x="360" y="185" width="230" height="80" rx="6" fill="#0f1a0f" stroke="#00ff41" stroke-width="2"/>
+  <text x="475" y="220" text-anchor="middle" class="grn">2. Write new</text>
+  <text x="475" y="250" text-anchor="middle" class="grn">string to SRAM</text>
+
+  <!-- Arrow -->
+  <line x1="590" y1="225" x2="635" y2="225" stroke="#888888" stroke-width="3"/>
+  <polygon points="635,215 660,225 635,235" fill="#888888"/>
+
+  <!-- Step 3 -->
+  <rect x="665" y="185" width="230" height="80" rx="6" fill="#1a1a0f" stroke="#ffaa00" stroke-width="2"/>
+  <text x="780" y="220" text-anchor="middle" class="amb">3. Set r0 to</text>
+  <text x="780" y="250" text-anchor="middle" class="amb">SRAM addr</text>
+
+  <!-- Arrow -->
+  <line x1="895" y1="225" x2="940" y2="225" stroke="#888888" stroke-width="3"/>
+  <polygon points="940,215 965,225 940,235" fill="#888888"/>
+
+  <!-- Step 4 -->
+  <rect x="970" y="185" width="180" height="80" rx="6" fill="#1a0f0f" stroke="#ff0040" stroke-width="2"/>
+  <text x="1060" y="220" text-anchor="middle" class="red">4. Continue</text>
+  <text x="1060" y="250" text-anchor="middle" class="red">execution</text>
+
+  <text x="600" y="340" text-anchor="middle" class="txt">printf reads r0, prints "hacky, world"!</text>
+
+  <!-- Bottom Left: Normal Flow -->
+  <rect x="30" y="405" width="560" height="375" class="pnl" rx="8"/>
+  <text x="310" y="448" text-anchor="middle" class="sub">Normal Flow</text>
+  <line x1="50" y1="463" x2="570" y2="463" stroke="#1a1a2e"/>
+
+  <rect x="55" y="485" width="500" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="70" y="513" class="txt">LDR r0, ="hello"</text>
+
+  <rect x="55" y="537" width="500" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="70" y="565" class="txt">BL printf</text>
+
+  <text x="310" y="630" text-anchor="middle" class="grn">Output:</text>
+  <text x="310" y="665" text-anchor="middle" class="txt">"hello, world"</text>
+
+  <text x="310" y="735" text-anchor="middle" class="dim">Prints original string</text>
+
+  <!-- Bottom Right: Hacked Flow -->
+  <rect x="620" y="405" width="550" height="375" class="pnl" rx="8"/>
+  <text x="895" y="448" text-anchor="middle" class="sub">Hacked Flow</text>
+  <line x1="640" y1="463" x2="1150" y2="463" stroke="#1a1a2e"/>
+
+  <rect x="645" y="485" width="500" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="660" y="513" class="txt">LDR r0, ="hello"</text>
+
+  <rect x="645" y="537" width="500" height="42" rx="4" fill="#1a0f0f" stroke="#ff0040" stroke-width="2"/>
+  <text x="660" y="565" class="red">r0 = 0x20040000</text>
+
+  <rect x="645" y="589" width="500" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="660" y="617" class="txt">BL printf</text>
+
+  <text x="895" y="682" text-anchor="middle" class="red">Output:</text>
+  <text x="895" y="717" text-anchor="middle" class="txt">"hacky, world"</text>
+
+  <text x="895" y="755" text-anchor="middle" class="dim">Prints our string</text>
+</svg>
@@ -0,0 +1,80 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800">
+<style>
+  .bg{fill:#0a0a0f}.pnl{fill:#12121a;stroke:#1a1a2e}.hdr{fill:#12121a}
+  .title{font:bold 42px 'Courier New',monospace;fill:#00ff41}
+  .sub{font:bold 28px 'Courier New',monospace;fill:#00d4ff}
+  .txt{font:24px 'Courier New',monospace;fill:#c0c0c0}
+  .dim{font:20px 'Courier New',monospace;fill:#888}
+  .grn{font:bold 24px 'Courier New',monospace;fill:#00ff41}
+  .red{font:bold 24px 'Courier New',monospace;fill:#ff0040}
+  .cyn{font:bold 24px 'Courier New',monospace;fill:#00d4ff}
+  .amb{font:bold 24px 'Courier New',monospace;fill:#ffaa00}
+  .badge{stroke:#00ff41;rx:14}
+</style>
+<rect class="bg" width="1200" height="800"/>
+
+<!-- Title -->
+<text x="600" y="52" text-anchor="middle" class="title">Failed vs Real Hack</text>
+<text x="600" y="88" text-anchor="middle" class="dim">Attack Methodology</text>
+
+  <!-- Left Panel: Failed Attempt -->
+  <rect x="30" y="105" width="560" height="675" class="pnl" rx="8"/>
+  <text x="310" y="148" text-anchor="middle" class="sub">Failed Attempt</text>
+  <line x1="50" y1="163" x2="570" y2="163" stroke="#1a1a2e"/>
+
+  <text x="55" y="205" class="red">The Bad Idea</text>
+  <text x="55" y="240" class="txt">Set r0 to point</text>
+  <text x="55" y="272" class="txt">at a string literal</text>
+  <text x="55" y="304" class="txt">like "hacky"</text>
+
+  <line x1="50" y1="332" x2="570" y2="332" stroke="#1a1a2e"/>
+
+  <text x="55" y="372" class="amb">Why It Fails</text>
+  <text x="55" y="407" class="txt">r0 only holds a</text>
+  <text x="55" y="439" class="txt">32-bit number</text>
+  <text x="55" y="471" class="txt">Not a string itself!</text>
+
+  <line x1="50" y1="499" x2="570" y2="499" stroke="#1a1a2e"/>
+
+  <text x="55" y="539" class="red">set $r0 = "HACK"</text>
+  <text x="55" y="574" class="txt">GDB interprets this</text>
+  <text x="55" y="611" class="txt">as an address value</text>
+  <text x="55" y="643" class="txt">pointing to garbage</text>
+
+  <line x1="50" y1="671" x2="570" y2="671" stroke="#1a1a2e"/>
+
+  <text x="310" y="710" text-anchor="middle" class="red">Result: CRASH</text>
+  <text x="310" y="745" text-anchor="middle" class="dim">or prints garbage</text>
+
+  <!-- Right Panel: Real Hack -->
+  <rect x="620" y="105" width="550" height="675" class="pnl" rx="8"/>
+  <text x="895" y="148" text-anchor="middle" class="sub">Real Hack</text>
+  <line x1="640" y1="163" x2="1150" y2="163" stroke="#1a1a2e"/>
+
+  <text x="645" y="205" class="grn">The Right Way</text>
+  <text x="645" y="240" class="txt">1. Write string</text>
+  <text x="645" y="272" class="txt">   bytes to SRAM</text>
+  <text x="645" y="304" class="txt">2. Point r0 to</text>
+  <text x="645" y="336" class="txt">   that SRAM addr</text>
+
+  <line x1="640" y1="364" x2="1150" y2="364" stroke="#1a1a2e"/>
+
+  <text x="645" y="404" class="cyn">GDB Commands</text>
+
+  <rect x="645" y="425" width="480" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="660" y="453" class="grn">set {char[13]}0x20040000</text>
+
+  <rect x="645" y="477" width="480" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="660" y="505" class="grn">  = "hacky, world"</text>
+
+  <rect x="645" y="539" width="480" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="660" y="567" class="amb">set $r0 = 0x20040000</text>
+
+  <line x1="640" y1="610" x2="1150" y2="610" stroke="#1a1a2e"/>
+
+  <text x="645" y="650" class="txt">String exists in</text>
+  <text x="645" y="682" class="txt">writable SRAM</text>
+  <text x="645" y="714" class="txt">r0 points to it</text>
+
+  <text x="895" y="760" text-anchor="middle" class="grn">"hacky, world" printed!</text>
+</svg>
@@ -0,0 +1,83 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800">
+<style>
+  .bg{fill:#0a0a0f}.pnl{fill:#12121a;stroke:#1a1a2e}.hdr{fill:#12121a}
+  .title{font:bold 42px 'Courier New',monospace;fill:#00ff41}
+  .sub{font:bold 28px 'Courier New',monospace;fill:#00d4ff}
+  .txt{font:24px 'Courier New',monospace;fill:#c0c0c0}
+  .dim{font:20px 'Courier New',monospace;fill:#888}
+  .grn{font:bold 24px 'Courier New',monospace;fill:#00ff41}
+  .red{font:bold 24px 'Courier New',monospace;fill:#ff0040}
+  .cyn{font:bold 24px 'Courier New',monospace;fill:#00d4ff}
+  .amb{font:bold 24px 'Courier New',monospace;fill:#ffaa00}
+  .badge{stroke:#00ff41;rx:14}
+</style>
+<rect class="bg" width="1200" height="800"/>
+
+<!-- Title -->
+<text x="600" y="52" text-anchor="middle" class="title">Writing to SRAM</text>
+<text x="600" y="88" text-anchor="middle" class="dim">Memory Manipulation</text>
+
+  <!-- Left Panel: Memory View -->
+  <rect x="30" y="105" width="540" height="675" class="pnl" rx="8"/>
+  <text x="300" y="148" text-anchor="middle" class="sub">SRAM at 0x20040000</text>
+  <line x1="50" y1="163" x2="550" y2="163" stroke="#1a1a2e"/>
+
+  <!-- Before -->
+  <text x="55" y="205" class="red">Before (empty)</text>
+
+  <rect x="55" y="225" width="490" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="70" y="253" class="dim">00 00 00 00 00 00 00 00</text>
+
+  <rect x="55" y="277" width="490" height="42" rx="4" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="70" y="305" class="dim">00 00 00 00 00 00 00 00</text>
+
+  <!-- After -->
+  <text x="55" y="370" class="grn">After writing</text>
+
+  <rect x="55" y="390" width="490" height="42" rx="4" fill="#0f1a0f" stroke="#00ff41" stroke-width="2"/>
+  <text x="70" y="418" class="grn">68 61 63 6b 79 2c 20 77</text>
+
+  <text x="55" y="470" class="dim">h  a  c  k  y  ,     w</text>
+
+  <!-- The GDB command -->
+  <text x="55" y="530" class="amb">GDB Command:</text>
+
+  <rect x="55" y="548" width="490" height="90" rx="5" fill="#0a0a0f" stroke="#ffaa00" stroke-width="2"/>
+  <text x="70" y="580" class="txt">set {char[13]}</text>
+  <text x="70" y="612" class="txt">0x20040000 = "hacky, world"</text>
+
+  <!-- Verify -->
+  <text x="55" y="680" class="cyn">Verify with:</text>
+  <rect x="55" y="698" width="490" height="42" rx="5" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="70" y="726" class="txt">x/s 0x20040000</text>
+
+  <!-- Right Panel: Why SRAM -->
+  <rect x="600" y="105" width="570" height="675" class="pnl" rx="8"/>
+  <text x="885" y="148" text-anchor="middle" class="sub">Why SRAM?</text>
+  <line x1="620" y1="163" x2="1150" y2="163" stroke="#1a1a2e"/>
+
+  <text x="625" y="205" class="grn">SRAM = writable</text>
+  <text x="625" y="240" class="txt">RAM at 0x20000000</text>
+  <text x="625" y="272" class="txt">We can write any</text>
+  <text x="625" y="304" class="txt">data here via GDB</text>
+
+  <line x1="620" y1="332" x2="1150" y2="332" stroke="#1a1a2e"/>
+
+  <text x="625" y="372" class="red">Flash = read-only</text>
+  <text x="625" y="407" class="txt">XIP at 0x10000000</text>
+  <text x="625" y="439" class="txt">Cannot write to it</text>
+  <text x="625" y="471" class="txt">during execution</text>
+  <text x="625" y="503" class="dim">That's why we use RAM</text>
+
+  <line x1="620" y1="531" x2="1150" y2="531" stroke="#1a1a2e"/>
+
+  <text x="625" y="571" class="amb">Choosing Address</text>
+  <text x="625" y="606" class="txt">0x20040000 is safe</text>
+  <text x="625" y="638" class="txt">Far from stack</text>
+  <text x="625" y="670" class="txt">and heap regions</text>
+
+  <line x1="620" y1="698" x2="1150" y2="698" stroke="#1a1a2e"/>
+
+  <text x="625" y="738" class="cyn">Null terminator</text>
+  <text x="625" y="773" class="dim">\0 ends the string</text>
+</svg>
@@ -0,0 +1,77 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800">
+<style>
+  .bg{fill:#0a0a0f}.pnl{fill:#12121a;stroke:#1a1a2e}.hdr{fill:#12121a}
+  .title{font:bold 42px 'Courier New',monospace;fill:#00ff41}
+  .sub{font:bold 28px 'Courier New',monospace;fill:#00d4ff}
+  .txt{font:24px 'Courier New',monospace;fill:#c0c0c0}
+  .dim{font:20px 'Courier New',monospace;fill:#888}
+  .grn{font:bold 24px 'Courier New',monospace;fill:#00ff41}
+  .red{font:bold 24px 'Courier New',monospace;fill:#ff0040}
+  .cyn{font:bold 24px 'Courier New',monospace;fill:#00d4ff}
+  .amb{font:bold 24px 'Courier New',monospace;fill:#ffaa00}
+  .badge{stroke:#00ff41;rx:14}
+</style>
+<rect class="bg" width="1200" height="800"/>
+
+<!-- Title -->
+<text x="600" y="52" text-anchor="middle" class="title">Register Hijack</text>
+<text x="600" y="88" text-anchor="middle" class="dim">Control Flow Attack</text>
+
+  <!-- Left Panel: Before Hijack -->
+  <rect x="30" y="105" width="540" height="675" class="pnl" rx="8"/>
+  <text x="300" y="148" text-anchor="middle" class="sub">Before Hijack</text>
+  <line x1="50" y1="163" x2="550" y2="163" stroke="#1a1a2e"/>
+
+  <text x="55" y="205" class="dim">r0 loaded by LDR:</text>
+
+  <rect x="55" y="225" width="490" height="55" rx="5" fill="#0f0f1a" stroke="#00d4ff" stroke-width="2"/>
+  <text x="70" y="260" class="cyn">r0 = 0x10001234</text>
+
+  <text x="55" y="320" class="dim">Points to flash:</text>
+
+  <rect x="55" y="340" width="490" height="55" rx="5" fill="#0a0a0f" stroke="#1a1a2e"/>
+  <text x="70" y="375" class="txt">"hello, world\r\n"</text>
+
+  <text x="55" y="440" class="dim">printf will read r0</text>
+  <text x="55" y="472" class="dim">and print that string</text>
+
+  <line x1="50" y1="510" x2="550" y2="510" stroke="#1a1a2e"/>
+
+  <text x="55" y="555" class="grn">The Hijack Command</text>
+
+  <rect x="55" y="575" width="490" height="55" rx="5" fill="#1a0f0f" stroke="#ff0040" stroke-width="2"/>
+  <text x="300" y="610" text-anchor="middle" class="red">set $r0 = 0x20040000</text>
+
+  <text x="300" y="680" text-anchor="middle" class="txt">Now r0 points to</text>
+  <text x="300" y="712" text-anchor="middle" class="txt">OUR string in SRAM</text>
+  <text x="300" y="744" text-anchor="middle" class="dim">instead of flash</text>
+
+  <!-- Right Panel: After Hijack -->
+  <rect x="600" y="105" width="570" height="675" class="pnl" rx="8"/>
+  <text x="885" y="148" text-anchor="middle" class="sub">After Hijack</text>
+  <line x1="620" y1="163" x2="1150" y2="163" stroke="#1a1a2e"/>
+
+  <text x="625" y="205" class="dim">r0 now contains:</text>
+
+  <rect x="625" y="225" width="520" height="55" rx="5" fill="#1a0f0f" stroke="#ff0040" stroke-width="2"/>
+  <text x="640" y="260" class="red">r0 = 0x20040000</text>
+
+  <text x="625" y="320" class="dim">Points to SRAM:</text>
+
+  <rect x="625" y="340" width="520" height="55" rx="5" fill="#0f1a0f" stroke="#00ff41" stroke-width="2"/>
+  <text x="640" y="375" class="grn">"hacky, world"</text>
+
+  <line x1="620" y1="430" x2="1150" y2="430" stroke="#1a1a2e"/>
+
+  <text x="625" y="470" class="amb">Then: continue</text>
+  <text x="625" y="510" class="txt">printf reads r0</text>
+  <text x="625" y="542" class="txt">Follows pointer</text>
+  <text x="625" y="574" class="txt">to 0x20040000</text>
+  <text x="625" y="606" class="txt">Finds "hacky, world"</text>
+  <text x="625" y="638" class="txt">Prints it!</text>
+
+  <line x1="620" y1="678" x2="1150" y2="678" stroke="#1a1a2e"/>
+
+  <text x="885" y="720" text-anchor="middle" class="grn">Output changed</text>
+  <text x="885" y="752" text-anchor="middle" class="grn">without touching code</text>
+</svg>
@@ -0,0 +1,75 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 800">
+<style>
+  .bg{fill:#0a0a0f}.pnl{fill:#12121a;stroke:#1a1a2e}.hdr{fill:#12121a}
+  .title{font:bold 42px 'Courier New',monospace;fill:#00ff41}
+  .sub{font:bold 28px 'Courier New',monospace;fill:#00d4ff}
+  .txt{font:24px 'Courier New',monospace;fill:#c0c0c0}
+  .dim{font:20px 'Courier New',monospace;fill:#888}
+  .grn{font:bold 24px 'Courier New',monospace;fill:#00ff41}
+  .red{font:bold 24px 'Courier New',monospace;fill:#ff0040}
+  .cyn{font:bold 24px 'Courier New',monospace;fill:#00d4ff}
+  .amb{font:bold 24px 'Courier New',monospace;fill:#ffaa00}
+  .badge{stroke:#00ff41;rx:14}
+</style>
+<rect class="bg" width="1200" height="800"/>
+
+<!-- Title -->
+<text x="600" y="52" text-anchor="middle" class="title">GDB vs Ghidra</text>
+<text x="600" y="88" text-anchor="middle" class="dim">Static vs Dynamic Analysis</text>
+
+  <!-- Left Panel: GDB -->
+  <rect x="30" y="105" width="560" height="675" class="pnl" rx="8"/>
+  <text x="310" y="148" text-anchor="middle" class="sub">GDB (Dynamic)</text>
+  <line x1="50" y1="163" x2="570" y2="163" stroke="#1a1a2e"/>
+
+  <text x="55" y="205" class="grn">Live analysis</text>
+  <text x="55" y="240" class="txt">Program is running</text>
+  <text x="55" y="272" class="txt">on real hardware</text>
+
+  <line x1="50" y1="300" x2="570" y2="300" stroke="#1a1a2e"/>
+
+  <text x="55" y="340" class="cyn">Capabilities</text>
+  <text x="55" y="375" class="txt">Set breakpoints</text>
+  <text x="55" y="407" class="txt">Read/write memory</text>
+  <text x="55" y="439" class="txt">Modify registers</text>
+  <text x="55" y="471" class="txt">Step instructions</text>
+  <text x="55" y="503" class="txt">Watch values change</text>
+
+  <line x1="50" y1="531" x2="570" y2="531" stroke="#1a1a2e"/>
+
+  <text x="55" y="571" class="amb">Best For</text>
+  <text x="55" y="606" class="txt">Live modification</text>
+  <text x="55" y="638" class="txt">Runtime behavior</text>
+  <text x="55" y="670" class="txt">Testing exploits</text>
+  <text x="55" y="702" class="txt">Verifying attacks</text>
+
+  <text x="310" y="755" text-anchor="middle" class="dim">Needs running target</text>
+
+  <!-- Right Panel: Ghidra -->
+  <rect x="620" y="105" width="550" height="675" class="pnl" rx="8"/>
+  <text x="895" y="148" text-anchor="middle" class="sub">Ghidra (Static)</text>
+  <line x1="640" y1="163" x2="1150" y2="163" stroke="#1a1a2e"/>
+
+  <text x="645" y="205" class="red">Offline analysis</text>
+  <text x="645" y="240" class="txt">Just the binary file</text>
+  <text x="645" y="272" class="txt">No hardware needed</text>
+
+  <line x1="640" y1="300" x2="1150" y2="300" stroke="#1a1a2e"/>
+
+  <text x="645" y="340" class="cyn">Capabilities</text>
+  <text x="645" y="375" class="txt">Disassembly view</text>
+  <text x="645" y="407" class="txt">Decompile to C</text>
+  <text x="645" y="439" class="txt">Find functions</text>
+  <text x="645" y="471" class="txt">Cross-references</text>
+  <text x="645" y="503" class="txt">String search</text>
+
+  <line x1="640" y1="531" x2="1150" y2="531" stroke="#1a1a2e"/>
+
+  <text x="645" y="571" class="amb">Best For</text>
+  <text x="645" y="606" class="txt">Planning attacks</text>
+  <text x="645" y="638" class="txt">Understanding code</text>
+  <text x="645" y="670" class="txt">Finding targets</text>
+  <text x="645" y="702" class="txt">Mapping functions</text>
+
+  <text x="895" y="755" text-anchor="middle" class="dim">Works with just ELF</text>
+</svg>