The binary, script for exploitation, and a PDF of the solution can be found in this repository:
Binary, script for exploitation, and PDF of solutionI completed this challenge using a combination of brute force and static analysis. The first question will not throw the user into the gorge regardless of what input is given, so nothing needs to be solved there. The second question asks for 2 numbers such that the second number == first number when it is manipulated through func2. I used brute force to initially explore what inputs would lead to what outputs. While exploring, I was able to brute force the answer. The script is below:
For the third question, for each number in [1,2,3…,9], the program asks for two inputs such that forestOfEwing[input2 + input1*256] == number. So, for each number in [1,2,3…,9], I found the number in the forestOfEwing array, calculated input1 by dividing its index in the array by 256, and calculated input2 by finding the remainder of its index divided by 256. By doing this, I was able to clear bridge of death.