Confusion Hall

spbctf

Task: heap menu program with type confusion — struct number (u64) and struct str (char*) share the same 8-byte slot in a global OBJECTS[] array with no runtime type check. Solution: add a number equal to the fixed address of the No-PIE FLAG global, then show it as a str so printf(%s) dereferences the forged pointer and prints the flag.