Bad Memories -v0.9- -recreation- Link

Flag: CTFBad_Memories_Unleash_Secret_Recreation Alternatively, the flag might already be in memory. Dump all strings from core:

[0x00401234]> afl | grep secret 0x00401456 sym.secret_function Disassemble secret_function : Bad Memories -v0.9- -recreation-

However, this core dump is process-only. Use elfutils : Bad Memories -v0.9- -recreation-

(gdb) x/10gx 0x6020a0 Shows 0x401456 in the vtable slot – that’s the secret function address! Bad Memories -v0.9- -recreation-