characteristic

pwn_spbctf

Task: x86-64 PIE/NX/canary binary mmaps a RWX page, reads shellcode, and rejects it if any byte equals one of several random forbidden bytes. Solution: the forbidden bytes are leaked via printf at startup, so parse them and send an execve(/bin/sh) shellcode containing none of them; an XOR-decoder with a brute-forced key is the robust fallback when the base shellcode collides.