[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_160":161,"_162":155},"routes/_root/_root",{"_157":-7,"_40":158,"_127":-7,"_159":-7},"routes/_root.challenges",{"_36":153,"_154":155,"_156":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_60":61,"_62":63,"_64":65},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25,26],"name","Flag Printer 20XX","canonicalName","flag-printer-20xx",{"_27":54,"_29":55,"_31":56,"_33":16,"_34":16,"_35":16,"_36":50,"_38":57,"_40":41,"_42":16,"_43":58},{"_27":47,"_29":48,"_31":49,"_33":16,"_34":16,"_35":16,"_36":50,"_38":51,"_40":41,"_42":16,"_43":52},{"_27":28,"_29":30,"_31":32,"_33":16,"_34":16,"_35":16,"_36":37,"_38":39,"_40":41,"_42":16,"_43":44},"author",{"_20":45,"_46":-5},"writeupElementId","f0a043f8","writeupId","f0a043f8-94fd-4b60-a9f4-0e975dd97bd1","canEdit","canLike","likedByViewer","title","Daily AlpacaHackに挑戦するつくよみちゃん 06/19/Flag Printer 20XX/minaminao","url","https://youtu.be/BTSKQcIShDc","language","ja","isOfficial","createdAt",["D",1781968338923],"tsukuyomi-chan","gravatarHash",{"_20":53,"_46":-5},"5755ff25","5755ff25-878a-48b7-bb8b-89679f03a5ba","Writeup for Flag Printer 20XX","https://github.com/baumroll0928-spec/myRepository/tree/main/Daily_AlpacaHack/m202606/d19_Flag_Printer_20XX",["D",1781884962448],"baumroll1234",{"_20":59,"_46":-5},"8b8fd155","8b8fd155-9117-40f9-9e1f-03711b11fd71","https://github.com/goroshirow/CTF-WriteUps/blob/main/AlpacaHack/2026Jun/Flag%20Printer%2020XX.md",["D",1781882414771],"goroshirow","challenge",{"_20":21,"_22":23,"_69":70,"_71":72,"_73":74,"_75":76,"_77":78,"_79":80,"_81":82,"_83":16,"_84":-7,"_85":86,"_87":-7,"_88":-7,"_35":16,"_89":90,"_91":92,"_93":16,"_94":-7,"_95":16,"_96":-7,"_97":-7,"_98":99,"_100":-7,"_101":-7,"_102":-7,"_103":104,"_105":16,"_106":104,"_34":104,"_107":-7,"_108":109,"_110":111,"_112":113,"_114":115},"availablePages",[66,67,68],"canonicalUrl","https://alpacahack.com/challenges/flag-printer-20xx","Description","Solves","Writeups","solves",59,"flagFormat","Alpaca{...}","categories",[150],"attachments",[146],"remote",{"_143":144,"_145":104},"description","[Flag Printer 2026](/daily/challenges/flag-printer-2026) - timeout + arbitrary 1-byte write\n\nNOTE: You don't need to solve Flag Printer 2026 first.\n\n

Beginner Hint 1 (AI-translated)

\n\n- In this challenge, the flag is printed one character at a time, only for the length of `Alpaca{`. In other words, only `Alpaca{` is printed.\n- However, you can operate on `/proc/self/mem` before the output happens.\n- `/proc/self/mem` is one of the files in the [process filesystem](/tags/procfs), and it refers to the current process's own virtual memory.\n- It is usually used by checking valid memory ranges with `/proc/self/maps`, seeking to one of those addresses, and then reading from it.\n- In this challenge, you can use this `/proc/self/mem` mechanism to write an arbitrary 1 byte to an arbitrary address.\n- Also, `id(0)` is printed as a hint, so you can find the address of `0`.\n- How can you print the flag?\n

\n\n

Beginner Hint 2 (AI-translated)

\n\n- This loop uses various integer objects internally, including `i`.\n- First, check how integer objects are laid out in memory.\n- Then, investigate how values are stored in integer objects.\n- Also, try rewriting a suitable integer object and see how the script's behavior changes.\n

\n","descriptionJa","[Flag Printer 2026](/daily/challenges/flag-printer-2026) - timeout + arbitrary 1-byte write\n\nNOTE: Flag Printer 2026 を先に解く必要はありません。\n\n

初心者向けヒント1

\n\n- この問題では、フラグを `Alpaca{` の長さ分、一文字ずつ出力しています。つまり、`Alpaca{` しか出力されません。\n- しかし、出力する前に `/proc/self/mem` を操作できます。\n- `/proc/self/mem` は [プロセスファイルシステム](/tags/procfs) の一つで、現在のプロセス自身の仮想メモリを指します。\n- 通常は `/proc/self/maps` で有効なメモリ範囲を確認してから、そのアドレスに seek して読むといった使い方をします。\n- この問題では、この `/proc/self/mem` の仕組みを使って、任意のアドレスに任意の1バイトを書き込むことができます。\n- また、 `id(0)` がヒントとして出力されており、 `0` のアドレスを確認できます。\n- では、どうしたらフラグを出力できるでしょうか？\n

\n\n

初心者向けヒント2

\n\n- このループでは、`i` を始め、内部で様々な整数オブジェクトが使われています。\n- まずは、整数オブジェクトがどのようなレイアウトでメモリに保存されているかを確認してみましょう。\n- そして、整数オブジェクトにどのように数値が保存されているか調査してみましょう。\n- また、適当な整数オブジェクトを書き換えて、どうスクリプトの挙動が変わるかを試してみましょう。\n

\n","descriptionRequiresSignIn","changeLog","authors",[140],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[129,130,131,132],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_116":117,"_98":99,"_118":119,"_120":121,"_122":123,"_124":125},"nextDailyCanonical","xorshift521","httpsProxyHostname","flag-printer-20xx.chal.alp4ca.com","program",{"_22":109,"_20":126,"_127":128},"scheduledDate",["D",1781794800000],"releaseAt",["D",1781794800000],"status","PUBLISHED","plannedTopic","Python","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":125,"_22":139},{"_20":137,"_22":138},{"_20":135,"_22":136},{"_20":133,"_22":134},"Flag Printer","flag-printer","Arbitrary Address Write","arbitrary-address-write","Memory","memory","python",{"_20":141,"_46":142},"minaminao","8923101afaa06c6be81216763685dbd0cac8ff24fbd6646250f67608d4924b02","instances",[],"canSpawn",{"_147":148,"_38":149},"fileName","flag-printer-20xx.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/af79ee8f-ff4e-4471-8219-10ac49bc6628/flag-printer-20xx.tar.gz",{"_20":151,"_22":152},"Misc","misc","Challenges","query","","isLoggedIn","user","en","timeZoneAbbr","clientConfig",{"_163":164,"_165":104,"_166":167,"_168":167,"_169":170,"_171":172,"_173":16,"_174":155},"cspNonce","firebaseOptions",{"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":170},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]