open wah in ghidra and see address of end flag function and send payload to it (see solve.py on link  here) and get flaghttps://github.com/uniimmortal/writeups.uniimmortal.github.io/tree/main/angstromctf2022/wah