Memory security & exploitation
The dark mirror of module 01: canaries, tcache poisoning, ROP, MTE, Rowhammer — every design decision as attack surface.
LIVEEvery technical field has a root layer its practitioners know and everyone else waves away. deep-roots goes down and stays there: each module rebuilds one field from the physics up, so that what others memorize, we derive. Module 01 — the memory models of programming languages — is the root of them all, and twenty-one more modules are now live: security, bugs, decompilation, Android, iOS, desktop kernels, COBOL, concurrency, compilers, databases, GPUs, networking, file systems, virtualization, browsers, hardware, cryptography, type systems, embedded, verification, ML infrastructure — connected by a thousand-plus cross-references (see the connections map). What insiders know, written down.
Twenty-three chapters in four parts. Every chapter ends with What insiders know, a See it yourself lab with real commands, the connections to every other chapter, and a quiz with worked answers. The whole module lands on one comparison table: sixteen languages, four questions, sixty years of design decisions.
Where every abstraction is derived, not asserted: the physics, the tower, the illusion, and the two machines every language divides labor between. Read in order — the rest of the module is this argument.
DRAM cells, addresses, alignment, endianness — why memory is shaped the way it is.
The latency tower, the 64-byte line, locality — the physics behind all performance.
Page tables, TLB, demand paging, COW, ASLR, swap — the OS grand illusion.
Frames, prologues, calling conventions — why local variables are free.
The everything-else machine: metadata, the three taxes, fragmentation.
Unboxed/boxed/tagged, headers, vtables, fat pointers — what a value really is.
Sixteen memory models, each positioned by the four questions: what is a value, who owns it, who frees it, what safety. From C’s explicit contract to COBOL’s radical alternative.
Ownership and borrows: safety at compile time — the third way.
Escape analysis, moving goroutine stacks, the concurrent GC.
The generational JVM heap: headers, TLABs, collectors, the 32 GB cliff.
Everything is a PyObject: refcounts, the cycle detector, pymalloc.
Hidden classes, the scavenger, the leak-hunting heap graph.
ARC: the compiler counts; side tables, COW, no swap.
The memory model with no heap: PICTURE bytes, fixed records, why banking runs on it.
Fortran, Lisp, Haskell, Erlang, Ada, Zig — where every idea was invented.
The machinery under malloc, the physics of multicore disagreement, the security consequences of every design decision, and the platforms that made memory a scheduled resource.
dlmalloc bins, tcache, tcmalloc, jemalloc, slab — the machinery under malloc.
MESI, store buffers, atomics, fences — why cores disagree about memory.
Overflows, UAF, heap attacks, ROP, Rowhammer — how every model fails.
Zygote, ART GC, Jetsam, compression — where the OS is the GC.
One table for every language, the instrument for every question, the practice path, and the exam.
One table for every language, the toolkit, the practice path.
Thirty questions across all twenty-three chapters, worked answers behind the fold — or take the interactive quiz.
Memory first because everything else is a consequence: security bugs are memory bugs, decompilation reads stack frames and vtables, mobile OSes are memory-driven schedulers, COBOL is a memory model, distributed consistency is the memory model at scale, and compilers, databases, and GPUs are the factory, the disk-scale, and the new wing of the same tower. The second round went further: networking, file systems, virtualization, browsers, and hardware. The third round closed the ring: cryptography (where a cache miss is a breach), type systems (the theory under every language the program taught), embedded (the safety net removed), verification (the proofs behind the promises), and ML infrastructure (the tower rebuilt at datacenter scale). Every module below is fully written, quizzed, and final-examined.
The dark mirror of module 01: canaries, tcache poisoning, ROP, MTE, Rowhammer — every design decision as attack surface.
LIVEThe bug classes senior engineers know by scar: memory, race, numeric, state — and how fuzzing and sanitizers actually find them.
LIVEReading what compilers leave behind: file formats from bytes up, calling conventions, vtable reconstruction, Ghidra/IDA.
LIVEZygote and COW, ART object model and GC, Binder, lmkd, OTA — an OS designed by memory constraints.
LIVEXNU VM, Jetsam bands, the compressor, Mach ports, DYLD shared cache, code signing as memory trust.
LIVEWindows (TEB/PEB, heap manager, LFH), Linux (ELF, vdso, slab, OOM), macOS (Mach VM, shared cache) — three concrete pagetable worlds.
LIVEThe fixed-record universe deep dive: storage sections, PICTURE, CICS, AMODE — why the world’s money runs on no heap.
LIVEFrom the hardware memory model to happens-before at scale: lock-free, RCU, CRDTs — memory and network converge.
LIVEWhere memory models are manufactured: register allocation, escape analysis, barrier insertion, layout choices.
LIVEThe disk is the new heap: B-trees, LSM, buffer pools as hierarchy, MVCC as copy-on-write.
LIVEHBM, the CUDA hierarchy, coalescing as cache lines, allocator arenas in training — a new level of the tower.
LIVEThe stack as a memory machine: DMA rings, sk_buff, TCP windows, epoll, io_uring, QUIC, RDMA — buffers all the way down.
LIVEThe disk is the heap that outlives the process: FTL garbage collection, the page cache, journals, CoW lineages, overlayfs.
LIVEVT-x, EPT, virtio rings, namespaces and cgroups, Firecracker — who owns the bytes at every layer.
LIVEAn OS that renders: process-per-site, Oilpan, the 16.6 ms budget, layout thrashing, site isolation.
LIVEThe root under the root: CMOS, pipelines, the FIFO ring in RTL, the cache born, yield arithmetic.
LIVEThe memory model of trust: entropy from physics, AES and its modes, bignum layouts as attack surface, TLS 1.3 as key erasure, the failure catalog.
LIVETypes as theorems: soundness proved, null as the billion-dollar lie, memory safety as a theorem, GC as proof search, the limits.
LIVEThe world with no MMU: the memory map in silicon, linker scripts as the memory model, interrupts and DMA, the RTOS, secure boot.
LIVEThe machines that prove programs: Hoare logic, model checking and the state explosion, seL4, the borrow checker as separation logic, CompCert.
LIVEThe distributed memory machine: tensors, the autograd tape, ZeRO and the five parallel axes, the KV cache, collectives and the datacenter.
LIVEFirst principles, downward. Each module starts at the physical layer and builds up — no fact is allowed to be memorized if it can be derived. Where a number matters, the number is stated and the platform named; where a simplification is made, it is flagged.
The insider test. Every chapter has a What insiders know section — the sizes, thresholds, flags, failure modes, and folklore that people inside the field use daily. See it yourself labs make every claim reproducible on a laptop: /proc, gdb, perf, ASan, heap snapshots, dumpsys. Research that nobody can check is a diary.
Quizzes with teeth, connections or it didn't happen. Questions predict output, diagnose bugs, and attack false intuitions — with worked answers. Every chapter ends by naming exactly what transfers to the other chapters and to the queued modules: one root, seventeen trees.
deep-roots is a learning program, not a tutorial dump. It is the education program of the srivtx line of work — a sibling of srivtx/p-rick, the research program on missing software. Where p-rick specifies software the world lacks, deep-roots rebuilds the knowledge most engineers lack. Both run the same discipline: work tracked in an automatic session ledger (agents.md), sources open, claims checkable.
Everything here is open: markdown sources, this site (GitHub Pages, dark and light), the interactive quiz, and the full roadmap. MIT-licensed — use it, teach it, fork it.