Pwning

Brute-force stack canary byte-by-byte via fork’s PID oracle, leak libc with puts, then ORW ROP chain.

Two’s complement INT_MIN negation overflow bypasses an absolute-value check to trigger the win condition.

Use-after-free on a tcache chunk to overwrite a function pointer and call win().

Blind format-string exploit with ASLR off: leak stack address then use %n + call rax to redirect execution.