ctfwriteup.com
Search…
⌃K

Puzzle 2

CODESIZE, SUB

Puzzle

############
# Puzzle 2 #
############
00 34 CALLVALUE
01 38 CODESIZE
02 03 SUB
03 56 JUMP
04 FD REVERT
05 FD REVERT
06 5B JUMPDEST
07 00 STOP
08 FD REVERT
09 FD REVERT
? Enter the value to send: (0)

Solution

CALLVALUE pushes msg.value onto the stack. CODESIZE pushes the size of this opcode sequence (which is 10) onto the stack. SUB pops two elements from the stack, subtracts them, and pushes the result back to the stack. At this moment the stack contains only one element 10-msg.value. JUMP will jump to 10-msg.value.
The objective is to jump to address 0x06, so we want 10-msg.value = 0x06, therefore the correct input is 4.
Last modified 1d ago