$ cat writeup.md…
$ cat writeup.md…
tamuctf
Task: ARM64 binary with UAF in close_channel (pointer not zeroed after free). Solution: Leak heap/PIE via stale metadata, tcache poisoning with safe-linking bypass to overwrite global auth, read flag.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar