pwnProhard

tuttis

pingCTF

Task: RISC-V 32-bit binary on Spike simulator with packet encoding/decoding. Solution: Exploit memset underflow in encode_packet to corrupt mtvec trap handler, transforming infinite loop into jump to controlled shellcode, then trigger misaligned access trap to execute payload that calls puts(FLAG).

$ ls tags/ techniques/
shellcoderisc-vrv32spike_simulatortrap_handlermtvecmemset_underflow
mtvec_corruptioninstruction_transformationmisaligned_access_trapshellcode_staging
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups