pwn5 intruder_1

pwn_spbctf

Task: NON-PIE room reservation pwn with an order/view array indexed by a signed 64-bit value, bounded only by a signed upper-bound check `cmp idx,0xff; jg`. Solution: bypass the bound with a 64-bit wraparound index idx=(flag-rooms)/8 - 2^61 (negative, passes `jg`) so rooms+idx*8 ≡ flag global (mod 2^64), then read four `%016llX` qwords and decode them little-endian to reconstruct the flag.