https://john-jkar.github.io/myblog/tags/ret2win/Recent content in Ret2win on 4mN3s14 | CTF Player & StudentHugoen-usWed, 18 Feb 2026 06:00:00 +0000https://john-jkar.github.io/myblog/posts/diappeared/Wed, 18 Feb 2026 06:00:00 +0000https://john-jkar.github.io/myblog/posts/diappeared/<h1 id="disappeared--daily-alpacahack-writeup">Disappeared — Daily Alpacahack Writeup</h1> <p><strong>Category:</strong> Pwn · <strong>Difficulty:</strong> Medium ·</p> <hr> <h2 id="overview">Overview</h2> <p>We&rsquo;re given source code and a netcat address. The code looks safe at first glance — there&rsquo;s a bounds check on the array index before any write. The trick is in the compile command:</p> <pre tabindex="0"><code>gcc -DNDEBUG -o chal main.c -no-pie </code></pre><p>Two flags matter: <code>-DNDEBUG</code> and <code>-no-pie</code>.</p> <hr> <h2 id="the-vulnerability">The Vulnerability</h2> <h3 id="-dndebug-silently-deletes-assert"><code>-DNDEBUG</code> silently deletes <code>assert()</code></h3> <p>The C standard specifies that when <code>NDEBUG</code> is defined, every <code>assert()</code> call is <strong>completely removed by the preprocessor</strong> — not weakened, not skipped at runtime. Deleted.</p>