rev/picker_4

rev/picker_4/flag.txt

@@ -0,0 +1 @@
+picoCTF{dummy_flag}

rev/picker_4/picker-IV.c

@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <unistd.h>
+
+
+void print_segf_message(){
+  printf("Segfault triggered! Exiting.\n");
+  sleep(15);
+  exit(SIGSEGV);
+}
+
+int win() {
+  FILE *fptr;
+  char c;
+
+  printf("You won!\n");
+  // Open file
+  fptr = fopen("flag.txt", "r");
+  if (fptr == NULL)
+  {
+      printf("Cannot open file.\n");
+      exit(0);
+  }
+
+  // Read contents from file
+  c = fgetc(fptr);
+  while (c != EOF)
+  {
+      printf ("%c", c);
+      c = fgetc(fptr);
+  }
+
+  printf("\n");
+  fclose(fptr);
+}
+
+int main() {
+  signal(SIGSEGV, print_segf_message);
+  setvbuf(stdout, NULL, _IONBF, 0); // _IONBF = Unbuffered
+
+  unsigned int val;
+  printf("Enter the address in hex to jump to, excluding '0x': ");
+  scanf("%x", &val);
+  printf("You input 0x%x\n", val);
+
+  void (*foo)(void) = (void (*)())val;
+  foo();
+}

rev/picker_4/solve.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+NC_HOST="saturn.picoctf.net"
+NC_PORT="55490"
+
+WIN_ADDR="$(nm -g ./picker-IV | grep win | cut -d' ' -f1)"
+
+# ./picker-IV <<<"$WIN_ADDR"
+
+nc "$NC_HOST" "$NC_PORT" <<<"$WIN_ADDR"