Exploiting a QuickJS-ng fast-array bug to expose stale JSValues, corrupt the global property table, and call std.loadFile
Turning a missing pyjnius type check into Java object confusion, native memory access, and code execution through a forged PyObject
Combining malloc-failure undefined behavior and signedness bugs to obtain NULL-based absolute memory access and code execution
DefCamp D-CTF Final
Hiding a syscall opcode inside an immediate and jumping into the instruction midpoint to bypass Capstone-based shellcode filtering
![[SAS CTF 2026] JSculator writeup](/_astro/SAS26.C8H7_A0o_28emzr.webp)
![[SECCON CTF 14] Gachiarray writeup](/_astro/seccon14.CPpgPmZa_tkyJ0.webp)
![[D-CTF] inline8](/_astro/d-ctf.C_wVRWf-_Z1f3OuT.webp)
![[H7CTF 2025] 0x0f05 writeup](/_astro/h7ctf.DX83Bz1u_1q0QBY.webp)