El Pipo.md
1 Category: #pwn 2 Rated Difficulty: #VeryEasy 3 Personal Difficulty: #VeryEasy 4 5 This is a very straight forward question. 6 7 Upon disassembling I realised that I just need to make var_9 into something other than 1 then ill get the flag 8 9 I also then realised that there is read into var_38 which is initialised before var_9 and of size 0x40 which is way bigger than int64_t of var_38. This will then allow me to overwrite the value for var_9 and got the flag 10 11 Upon reflecting I also realised that I could just inserted 47 characters instead of 0x40 by subtracting the offset of the variables from the base pointer in this case var_38 is at offset -0x38 while var_9 is at offset -0x9 so there is 47 bytes between them