How These Challenges Work

ChallengesRead this first15 minutesModule overview

What changes here

The labs offered hints and walkthroughs when you needed them. These challenges combine skills from several sections and leave you to choose the approach.

Learning objectives

What is different

• No milestones. A challenge states what it wants and stops. Working out the steps is the exercise.
• No hints. There are no <details> blocks to open.
• Combined targets. Each one needs material from two or three earlier sections, and it does not say which.
• A direct check. The flag confirms the result. Notes and writeups are optional.

Nothing here needs a technique the course has not taught. That is the rule these challenges are built to, and it is worth trusting when you are stuck: if you find yourself reaching for something you have never seen, you are probably on the wrong road rather than the hard part of the right one.

What you still get

The source. Every challenge ships with the complete program, exactly as every lab did.

That is deliberate. Working from a stripped binary is reverse engineering, which is a subject in its own right and not one this course has taught you. Removing the source would not make these challenges harder in an interesting way, it would make them a different course.

The build. Same build.sh, same compiler flags, same verified archive.

Recovery. Setup, extraction, digest checks and cleanup stay as explicit as they have always been. Being stuck on tar is not the exercise.

Where to get unstuck

Not from the challenge page. From the lessons.

If you need	Go back to
Reading a stack frame, overwriting a return address	Stack Smashing
Canaries, NX, ROP, ASLR and PIE	Mitigations
Logic bugs, out-of-bounds reads and writes	Bug Classes
Integer conversion, format strings	Bug Classes
Type confusion, stale references, races	Bug Classes
Chunk layout, reuse, heap overflow, use after free	The Heap

Rereading the lesson that covers the technique is not cheating, and it is not the same as being told which technique to use. That second thing is what you are practising.

Rules

Flags look like UNDERDUNN{some_words_here}. Paste exactly what the program printed, with no surrounding whitespace.

Do not brute force anything. Every value these challenges need can be derived from something the program tells you or something you can read in its source. Nothing rewards guessing, and guessing skips the reasoning these exercises practice.

Safety note

Scope, unchanged

Build and run these only inside the isolated course VM. Each challenge asks for one line on standard output.

Some of these do reach execution, which earlier sections deliberately stopped short of. Where they do, the target is a function in the program that prints the result. Not a shell, not persistence, not anything that leaves the process. That is the same rule the course has used since Section 2: the least harmful result that proves the intended control.

Do not point any of this at software you do not own or have written permission to test.

What counts as done

Paste the flag into the checker on the challenge page and check any stated runtime condition, such as a clean exit. That completes the challenge.

Keep your solver if you’d like to run it again. A writeup can be useful for sharing your approach, but it is optional and does not earn a separate completion level.

What the next page needs

A freight desk that will not release a consignment customs has not cleared, and nothing that clears one.