fptr Reborn

spbctf

Task: No-PIE x86_64 binary reads 64 bytes into an 8-byte BSS buffer immediately followed by a function pointer and its argument, then performs an indirect call. Solution: craft a 24-byte payload that places '/bin/sh' in buf, overwrites function_pointer with the provided my_system helper (system(rdi)), and sets function_arg to the address of '/bin/sh', spawning a shell.