I have a file named exploit.c inside which:

#include <stdbool.h>
#include <stdio.h>

const char y1 = 'a';
const char y2 = 'b';
const char y3 = 'x';
const char y4 = 'y';
const char y5 = 'i';
const char y6 = 'j';

char x1 = 'f' ^ 'a';
char x2 = 'l' ^ 'b';
char x3 = 'a' ^ 'x';
char x4 = 'g' ^ 'y';
char x5 = 'y' ^ 'i';
char x6 = '-' ^ 'j';

int main() {
  bool c = false;
  if(c) { printf("The flag is: %c%c%c%c%c%c%c%c%c%c%c\n", x1 ^ y1, x2 ^ y2, x3 ^ y3, x4 ^
y4, x4 ^ y4, x5 ^ y5, x6 ^ y6, x1 ^ y1, x2 ^ y2, x3 ^ y3, x4 ^ y4); }
  return 0;

How can I print out the flag without changing the value of boolean but with gcc and gdb?

  • f^a^a = f and so on flaggy-flag is spottable visually
    – blabb
    Apr 14, 2021 at 18:36
  • Do you assume that you don't have the sources or debug symbols?
    – Dvd848
    Apr 14, 2021 at 18:56
  • We assume that at least we have executable files Apr 15, 2021 at 2:23
  • You'd also need to assume that it has been compiled without optimisations; otherwise the executable would likely contain no remnants of the flag at all
    – Ian Cook
    Apr 20, 2021 at 7:24

2 Answers 2


The if statement is likely compiled into a conditional jump so you just need to step until the comparison and change the result. For example, if the jump is je or jne, you need to change the zero flag (ZF) to force the jump in the opposite direction.

For changing flags in GDB, see


Another option is to change the instruction pointer ($rip or $eip) to the location which corresponds to the if body.


It was pretty easy one so I could do myself:) We have exploit.c file where I need to debug it in order to get the flag with 'gcc'. I run the program with:

gcc -g exploit.c -o exploit

and got 'exploit' which is executable exploit.c file. To launch the binary under a debugger - gdb

gdb exploit

We have bool c = false; on line 21, so put the break line on it:

break 21

Then: I changed the value of c by this command: set variable c = true However, when I went to the next line by “next” it become false again. So I reset the value again: set variable c = true and then next button: Yay, it printed out the flag:

(gdb) next

The flag is: flaggy-flag
23    return 0;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.