По секрету всему свету (Telling the Whole World a Secret)

hackerlab

Task: ncurses note-taking app (SNFE.elf) in SFX archive with fake 'NOP' encryption; wgetnstr reads 80 chars into buffer with only 79 bytes before a gate variable. Solution: overflow the 80th byte to '}' (0x7d) to trigger system('cat ' + input), inject shell commands to find flag in /tmp/.root_backup/.root_lock.