pwn7 mc4 — The Epic Statistics Calculator

pwn_spbctf

Task: amd64 PIE/FULL RELRO/canary/NX statistics calculator; the flag is loaded into a heap chunk at startup. The 'set boundaries' option only checks start<count and end>=0 — no upper bound on end. Solution: drive an out-of-bounds heap read through Sum, then leak the flag byte-by-byte via cumulative-sum differencing past the numbers buffer into the flag chunk.