Writeup

  • We can use Ghidra to disassemble the exec.
  • The number of arguments given to the main() function must be equal to 2 (one is the name of the executable file).
  • The second argument (the one given to the executable in the command-line) is passed to the function check_string().

In check_string():

  • local_10 must be set to 0x4E305250 to call win() (carefully, use the little-endian encoding)
  • local_10 is stored at stack - 0x10
  • The buffer is stored at stack - 0x30
  • So the payload should consist of 32 (48 - 16) 'A' characters, followed by "\x50\x52\x30\x4E"