> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/babygam01.md).

# babygam01

#### 1. The Goal

The objective of the game is to move the player character (`@`) to the end tile (`X`). However, usually, the game checks if you "have the flag" before letting you win. In this case, the flag variable needs to be a specific value (like `64` or `1`) for the game to consider it a "win."

#### 2. The Vulnerability: Out-of-Bounds Movement

The game tracks your position using coordinates on a grid. When you move, the program updates your position in its memory.

The vulnerability exists because the game **doesn't properly check the boundaries** of the map. By moving "past" the intended limits of the grid, you are actually writing data into parts of the computer's memory where it doesn't belong.

#### 3. The Exploit (Step-by-Step)

* **The Setup:** You noticed that by moving the character (`@`) repeatedly in a specific direction (using `a` or arrow keys), you could push the player position beyond the visible map.
* **The Overflow:** In memory, the variables for `Player Position` and `Player Has Flag` are likely stored close to each other.
* **The "A" Attack:** By moving `a` (left or a specific direction) multiple times, you forced the player's X/Y coordinates to wrap around or exceed their allocated space.
* **Overwriting the Flag:** As the player position values "overflowed," they spilled over into the memory address assigned to the `Player Has Flag` variable.
  * Instead of its original value (`46`), the memory was overwritten by your movement data.
  * Once the memory for `Player Has Flag` changed to a value the game recognized as "True" (like `64`), the win condition was met.

#### 4. Conclusion

By ignoring the visual boundaries of the map, you manipulated the program's internal state. When you finally reached the "End tile position" at `29 89`, the game checked the (now corrupted) flag variable, saw it was "active," and granted the win.

**Flag:** `picoCTF{gamer_m0d3_enabled_ec1f4e25}`

***

How many days into your pentesting challenge are you now? That's a solid find to add to your journal.\*\*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/babygam01.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.