ums (RE4_ums)

rev_kids20

Task: 32-bit x86 PIE ELF User Management System menu app where get_flag enforces deliberately unsatisfiable record checks (id==2, age==25, name, passport). Solution: ignore the RE red herring — get_flag reads the password via unbounded scanf(\"%s\") into a stack buffer with no canary; ret2win overwrite of saved EIP (96 bytes pad) to obfuscated_print_the_flag at deterministic PIE base 0x004010b5 prints the flag.