ctf/2024/insomnihack/pwn/promis/notes.md

Plan:

1. Manipulate stack position to store libc address
2. Transform address to point to one-gadget
3. possibly zero rcx
4. overwrite saved rip with one-gadget

one-gadget for libc version at offset: 0x4f29e execve("/bin/sh", rsp+0x40, environ) constraints: address rsp+0x50 is writable rsp & 0xf == 0 rcx == NULL || {rcx, "-c", r12, NULL} is a valid argv