Flag Printer 2026 - timeout + arbitrary 1-byte write
NOTE: You don't need to solve Flag Printer 2026 first.
Beginner Hint 1 (AI-translated)
- In this challenge, the flag is printed one character at a time, only for the length of
Alpaca{. In other words, onlyAlpaca{is printed. - However, you can operate on
/proc/self/membefore the output happens. /proc/self/memis one of the files in the process filesystem, and it refers to the current process's own virtual memory.- It is usually used by checking valid memory ranges with
/proc/self/maps, seeking to one of those addresses, and then reading from it. - In this challenge, you can use this
/proc/self/memmechanism to write an arbitrary 1 byte to an arbitrary address. - Also,
id(0)is printed as a hint, so you can find the address of0. - How can you print the flag?
Beginner Hint 2 (AI-translated)
- This loop uses various integer objects internally, including
i. - First, check how integer objects are laid out in memory.
- Then, investigate how values are stored in integer objects.
- Also, try rewriting a suitable integer object and see how the script's behavior changes.