no_syscall

pwn_spbctf

Task: 64-bit NON-PIE shellcode runner that mmaps an RWX page, reads up to 0x1000 bytes, but blocks input via memmem scan for the literal SYSCALL opcode (0f 05). Solution: self-modifying shellcode — embed a harmless `0f 04 c3` gate, `inc byte [gate+1]` at runtime to forge `0f 05` (syscall;ret), then `call gate` for open/read/write of /flag; submitted input never literally contains 0f 05.