Bad Memories -v0.9- -recreation- Online

CTFBad_Memories_Unleash_Secret_Recreation To recreate the vulnerability locally:

In GDB, call the overwritten function:

So a note was freed, then its print_func pointer was overwritten via another allocation (use-after-free write), pointing to the secret function. The core dump captured the program after the exploit but before the flag was printed. We can manually trigger the print: Bad Memories -v0.9- -recreation-

Use gdb to inspect heap:

Flag: CTFBad_Memories_Unleash_Secret_Recreation Alternatively, the flag might already be in memory. Dump all strings from core: Dump all strings from core: strings core

strings core.dump | head -20 Noticed a binary name: ./bad_memories_v0.9 and a suspicious string: [!] You found a secret? Try -recreation- . We can fetch or reconstruct

eu-unstrip -n --core=core.dump This reveals the missing binary path and build ID. We can fetch or reconstruct. After recovering the binary (named bad_memories_v0.9 ), analyze it: