> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/03.-integer-overflow-md/challenge/hard/solution.md). # solution image image This challenge combines two vulnerabilities: an out-of-bounds read and a signed/unsigned mismatch. The `read_score` function does not perform any bounds checking on the index, allowing access beyond the `scores` array. By supplying index `8`, we read the next value in memory, which corresponds to the global `secret`. The leaked value appears as `-559038737` due to signed interpretation, but converting it to hexadecimal reveals `0xDEADBEEF`, which is the correct authentication key. Using this leaked key, we authenticate through option 3, which sets the `authenticated` variable to `1`. Once authenticated, selecting option 4 successfully prints the flag. Although the program also contains a second vulnerability in `apply_bonus` where a negative length bypasses checks and becomes a large unsigned value in `memcpy`, this bug is not required to solve the challenge. The exploit relies entirely on abusing the out-of-bounds read to leak sensitive data and bypass authentication. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/03.-integer-overflow-md/challenge/hard/solution.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.