pwn4 / call_fcn

pwn_spbctf

Task: 64-bit NON-PIE NX ELF whose main itself mmaps a RWX page, reads up to 0x400 bytes of shellcode into it and calls it. win_fcn prints the flag only if a global qword equals 0xcafebabe. Solution: write shellcode that sets the magic global then jumps to win_fcn at its absolute address; close the send half so the fixed-count fread returns EOF and the flag is printed.