> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/pie-time2.md).

# PIE time2

The goal of this challenge is to redirect the program's execution to a "win" function that prints the flag. The program provides two prompts:

1. **"Enter your name"**: Vulnerable to a format string attack.
2. **"Enter the address to jump to"**: Requires a specific memory address to redirect execution.

### **The Hurdles: PIE and ASLR**

The binary is compiled with **PIE (Position Independent Executable)**. This means that every time the program runs, it is loaded into a different location in memory. Hardcoding an address from a local run will not work on the remote server because of **ASLR (Address Space Layout Randomization)**.

### **Phase 1: The Leak (Format String Vulnerability)**

Since we cannot guess the address, we must trick the program into telling us where it is in memory. By providing a format string like `%19$p` in the name field, we instruct the program to print the 19th value off the stack, which happens to be a saved return address within the code segment.

**Terminal Execution:**

```
Enter your name: %19$p
0x60142a5c6441  <-- This is our "Live Leak"
```

### **Phase 2: Calculating the Static Offset**

While the absolute addresses change, the **relative distance** between any two points in the binary remains constant. Using a hex calculator or a Python terminal, we compare the static addresses found in the binary (using a tool like `objdump` or `GDB`):

* **Static Leak Point:** `0x1441`
* **Static Target (win function):** `0x136a`
* **Constant Offset:** `0x1441 - 0x136a = 0xd7`

### **Phase 3: The Dynamic Exploit**

To find the `win` function in the current running session, we take the **Live Leak** and subtract the **Constant Offset**.

**Calculation:** $$0x60142a5c6441 - 0xd7 = 0x60142a5c636a$$

### **Phase 4: Execution**

1. Connect to the server via `nc`.
2. Input `%19$p` to get the current leak.
3. Perform the subtraction locally: `python3 -c "print(hex(LEAK - 0xd7))"`.
4. Paste the resulting address into the second prompt.

**Result:**

```
enter the address to jump to, ex => 0x12345: 0x60142a5c636a
You win!
picoCTF{...flag_content...}
```

***

### **Key Takeaways**

* **PIE/ASLR** makes hardcoded addresses useless.
* **Format Strings** can be used to leak memory pointers.
* **Relative Offsets** are the "skeleton key" for navigating randomized memory spaces.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/pie-time2.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.