pwnhard

lasOS

volgactf2026

Task: bootable custom x86_64 OS image running under QEMU+KVM with a tiny syscall ABI for untrusted ring-3 code. Solution: abuse setregs to control SYSRETQ state, trigger a ring-0 #GP with non-canonical RCX, and redirect the #GP exception-name pointer to the kernel flag string so puts() prints it.

$ ls tags/ techniques/
x86_64qemukernelcustom_oskvmsyscall_interfacesysretnon_canonical_addressexception_handlerring3
sysret_noncanonical_rcxkernel_rsp_controlexception_name_table_pointer_overwritering0_exception_abuse
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]