[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_161":162,"_163":156},"routes/_root/_root",{"_158":-7,"_40":159,"_130":-7,"_160":-7},"routes/_root.challenges",{"_36":154,"_155":156,"_157":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_61":62,"_63":64,"_65":66},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25,26],"name","Only forward","canonicalName","only-forward",{"_27":54,"_29":55,"_31":56,"_33":16,"_34":16,"_35":16,"_36":37,"_38":57,"_40":41,"_42":16,"_43":58},{"_27":47,"_29":48,"_31":49,"_33":16,"_34":16,"_35":16,"_36":50,"_38":51,"_40":41,"_42":16,"_43":52},{"_27":28,"_29":30,"_31":32,"_33":16,"_34":16,"_35":16,"_36":37,"_38":39,"_40":41,"_42":16,"_43":44},"author",{"_20":45,"_46":-5},"writeupElementId","e9691b68","writeupId","e9691b68-85b3-4c1f-94c1-f61554177b3b","canEdit","canLike","likedByViewer","title","Writeup for Only forward","url","https://github.com/baumroll0928-spec/myRepository/tree/main/Daily_AlpacaHack/m202606/d28_Only_forward","language","ja","isOfficial","createdAt",["D",1782669365126],"baumroll1234","gravatarHash",{"_20":53,"_46":-5},"bdddb57a","bdddb57a-a6a0-4ca5-9b36-0633c4722c0e","Writeup for Only forward: 3 Solutions","https://github.com/goroshirow/CTF-WriteUps/blob/main/AlpacaHack/2026Jun/Only%20forward.md",["D",1782661576608],"goroshirow",{"_20":59,"_46":60},"377eac1a","377eac1a-01b5-4192-a627-634e07e6978e","https://nitcelcius.notion.site/Daily-AlpacaHack-26-06-28-Only-forward-671b187dc1a3401c82c9defed203c0b6?source=copy_link",["D",1782659899705],"nitcelcius","9b2f5f3f857cd2c52d4cd669d68c198cfc2bdc729ffab0fa7e859488cd2ace40","challenge",{"_20":21,"_22":23,"_70":71,"_72":73,"_74":75,"_76":77,"_78":79,"_80":81,"_82":83,"_84":85,"_86":16,"_87":-7,"_88":89,"_90":-7,"_91":-7,"_35":16,"_92":93,"_94":95,"_96":16,"_97":-7,"_98":16,"_99":-7,"_100":-7,"_101":102,"_103":-7,"_104":-7,"_105":-7,"_106":107,"_108":16,"_109":107,"_34":107,"_110":-7,"_111":112,"_113":114,"_115":116,"_117":118},"availablePages",[67,68,69],"canonicalUrl","https://alpacahack.com/challenges/only-forward","Description","Solves","Writeups","solves",61,"difficulty",65,"flagFormat","Alpaca{...}","categories",[151],"attachments",[147],"remote",{"_144":145,"_146":107},"description","Do not falter. Press on without hesitation. But whatever you do, do not wake it. Tread carefully.\n\n

Beginner Hint 1

\n\nThe first input is used as a format string. Try printing stack values and look for something that looks like a stack canary.\n\n

\n\n

Beginner Hint 2

\n\nThe binary is not PIE, so function addresses are fixed. Keep the canary unchanged, then redirect execution to the useful function.\n\n

\n","descriptionJa","怯むな。迷わず進め。ただし、奴は起こしてはならん。気をつけろ\n\n

初心者向けヒント1

\n\n1回目の入力はformat stringとして使われます。スタック上の値を表示して、stack canaryらしい値を探してみましょう。\n\n

\n\n

初心者向けヒント2

\n\nこのバイナリはPIEが無効なので、関数アドレスは固定です。canaryを壊さずに残し、その後の戻り先を便利な関数へ向けてみましょう。\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[141],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[132,133,134],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","hard","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_119":120,"_101":102,"_121":122,"_123":124,"_125":126,"_127":128},"nextDailyCanonical","nano-services","httpsProxyHostname","only-forward.chal.alp4ca.com","program",{"_22":112,"_20":129,"_130":131},"scheduledDate",["D",1782572400000],"releaseAt",["D",1782572400000],"status","PUBLISHED","plannedTopic","Stack","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":139,"_22":140},{"_20":137,"_22":138},{"_20":135,"_22":136},"Win Function","win-function","Canary Leak","canary-leak","Format String Bug","format-string-bug",{"_20":142,"_46":143},"pppp4649","7b13a3438ad8c15bfabba0dfb37099cd93b38f7775fb79be6d5f905b0eb92001","instances",[],"canSpawn",{"_148":149,"_38":150},"fileName","only-forward.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/3922826d-8fea-40f3-a8dd-5cecb2e4b6f8/only-forward.tar.gz",{"_20":152,"_22":153},"Pwn","pwn","Challenges","query","","isLoggedIn","user","en","timeZoneAbbr","clientConfig",{"_164":165,"_166":107,"_167":168,"_169":168,"_170":171,"_172":173,"_174":16,"_175":156},"cspNonce","firebaseOptions",{"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":171},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]