Why the %p????

[Nrdzi]

I was following along with your write up to try and get my flag (every flag is uniquely generated from the look of it) and I ran into an issue that took me like 30 min to get over. Apparently I wasn't using enough iterations '%p'. Why are we using 24 consecutive '%p' values to get the correct, full length API Token?

P.S. Thank you for your help as I struggled through this :)

[vivian-dai]

Good to hear the writeups helped!
I'm pretty terrible at binary exploitation but I'll try to make sense of this:

1. %p is for accessing the address of the pointer.
2. Here we see we'll have to overwrite the flag buffer before we can get to the flag. The flag buffer is 128 bits long which is the same as 16 characters (128/8).
3. If we input just 16 %ps and convert the last bit to hex, we'll see "ocip{FTC" and since we don't actually know how long the flag is, we just need to kind of guess until it yields a valid flag.

In all honesty, I don't understand how to do binary exploitation either, this is just the reasoning I came up with that happens to make the most sense.

[Nrdzi]

Gracias

[eclairevoyant]

We don't need to overwrite the flag buffer. Actually the flag buffer is 128 bytes, in C code one char is defined to be one byte, and there's a line of code which has char api_buf[FLAG_BUFFER]; which therefore reserves 128 bytes.

Each pointer for this binary happens to be 32 bits (aka 4 bytes), so if the flag was a bit longer and took up the full 128 bytes, we may have actually needed to type out %p over 128/4 = 32 times, plus another %p for each item above the buffer on the stack.