Имя Профи, назови своё имя 😎 (Pro Name, Say Your Name)

hackerlab

Task: a non-PIE ELF64 binary reads 0x100 bytes into a 16-byte stack buffer, giving a classic ROP entry point but the remote runtime does not match normal glibc assumptions. Solution: leak .dynamic, recover DT_DEBUG, walk link_map to fingerprint musl/gcompat, pivot into .bss, and use musl syscall gadgets to enumerate /app and read /app/flag.txt.