SINO (Socket In, No Out)

spbctf

Task: not-stripped x86-64 ELF network client receives a flag over a socket into a heap buffer, but the print is commented out and stdout/stderr are fclose'd before free(theFlag); get_msg is a 15k-line obfuscated function using an x32-ABI raw syscall to defeat strace/gdb. Solution: instead of reversing the socket protocol, hook free() via LD_PRELOAD and dump the freed buffer to a file (stdout/stderr are closed), running the binary under Docker linux/amd64 so it reaches the live server. First free() call is theFlag.