There are quite a few gadgets and only 16-byte overflow.But luckily, I find ` 0x00010364: pop {r3, pc};` using Ropper and```asm    .text:00010534                 MOV     R1, R3          ; buf    .text:00010538                 MOV     R0, #0          ; fd    .text:0001053C                 BL      read    .text:00010540                 MOV     R3, #0    .text:00010544                 MOV     R0, R3    .text:00010548                 SUB     SP, R11, #4    .text:0001054C                 LDMFD   SP!, {R11,PC}    .text:0001054C ; End of function main```using IDA.
So if we get our stack layout like```pop {r3,pc} gadget <- ret addrbaseMOV R1,R3 gadget```we're able to read something to `base'.
I choose write shellcode to `base` and  then return to base, thus we get a shell.
----------
[Exploit here](https://github.com/bash-c/pwn_repo/blob/master/inCTF2018_wARMup/solve.py)
Follow [me](https://github.com/bash-c) if you like this wrtteup :)