Letssplitturtles.part02.rar -

The core of this stage involved crafting a precision payload that aligned with the program's expectations of the turtle structure while redirecting the instruction pointer.

: The payload specifically targeted RDX and RAX to set up the final call. LetsSplitTurtles.part02.rar

: The first 16 bytes of the payload were used to point the RDI register toward a "slack" space in memory. The core of this stage involved crafting a

This write-up covers the second part of the challenge from CSAW CTF, focusing on the exploitation of a recursive data structure to achieve code execution. Challenge Overview This write-up covers the second part of the

The exploit was verified using to step through the turtle traversal logic. A critical finding during this phase was that the RBP (Base Pointer) register did not land at the expected offset, requiring a slight adjustment to the slack space to ensure the magic gadget was reached successfully.