> For the complete documentation index, see [llms.txt](https://0xten.gitbook.io/public/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xten.gitbook.io/public/uhc/quals/8th-edition/untitled.md).

# I like to buy or smth

## Interacting with the program

![](/files/-MgblDxGNuqvwFqGv4zE)

The remote program gives us a wallet, and the value changes if we sell something or when we buy something.

![](/files/-MgblTJPxR3BVglSfzHE)

We can buy the flag but we don't have that much money :/

The only thing it allows us to to sell is nullbytes, but it won't buy it for mor than $0.

![](/files/-MgbltVjo-ddmThLyv-E)

## Int Underflow

What we could do where is appeal to a technique called integer Underflow. But first, let's understand what a int overflow is.

{% embed url="<https://en.wikipedia.org/wiki/Integer_overflow>" %}

The maxium number that can be represented in a int is 2147483647 and if we add 1 to it, this will cause the signal to invert and we would get -2147483648 as the result.

The opposite thing happens when we subtract 1 from -2147483647, which results in 2147483648, that's an int underflow.

If we sell a nullbyte for -2147483647, when the program tries to subtract the value of the flag the integer would underflow and our wallet's new amount would be over 2 billion dollars, which is way more than enough to buy the flag.

## Exploit

![](/files/-Mgbp3f4AXOLZ1P5hocd)