pwn5 itmo

pwn_spbctf

Task: stripped NON-PIE x86-64 university state machine; an OOB grades[count]=grade write executes before the bound check and lands on the low byte of a format-string pointer used by a fixed-arg box printf. Solution: corrupt the format pointer to shift which directives run so %n targets a register-backed arg (rcx=code) set to the rector-flag address, abuse year==0 so %s(NULL) prints (null) instead of SIGSEGV, set the win global, then graduate to trigger system(\"cat flag.txt\").