> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/reverse-engineering/shop.md).
# shop
This challenge is a simple logic bug exploitation in a shop system where you can buy and sell items using coins.
At the start, you only have 40 coins, and the flag item (“Fruitful Flag”) costs 100 coins, so normally you cannot afford it. The vulnerability is in the input handling when buying items. The program does not properly validate negative numbers.
When you chose to buy item (1) “Average Apple” and entered `-10` as the quantity, the program incorrectly processed it. Instead of rejecting the input, it treated it in a way that increased your coins. This is an integer logic flaw where buying a negative quantity effectively gives you money instead of subtracting it. Because of this, your coins increased from 40 to 190.
After exploiting this bug, you now had enough coins to buy the flag. You then selected option (2) and bought 1 “Fruitful Flag” for 100 coins.
Instead of printing the flag directly as a string, the program returned it as a list of ASCII values: \[112 105 99 111 67 84 70 123 98 52 100 95 98 114 111 103 114 97 109 109 101 114 95 48 54 53 56 98 54 50 57 101 125 10]
Converting these decimal ASCII values to characters gives:
picoCTF{b4d\_brogrammer\_0658b629e}
So the full process was: first exploit the negative quantity bug to gain extra coins, then buy the flag item, and finally convert the returned ASCII values into a readable string to get the flag.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/reverse-engineering/shop.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.