pwn4 call_fcn_rop

pwn_spbctf

Task: NON-PIE 64-bit ELF with NX and no canary; a stack overflow in logic() and a win_fcn that prints the flag only if called with six exact register args. Solution: parse the libc base from the /proc/self/maps dump leaked at startup, then ret2libc system('/bin/sh') (with movaps stack alignment) instead of satisfying the 6-arg check, and read the real XOR-encoded flag from the server's /task binary .data.