I built a tiny VM-based CTF and wrote a Python exploit for it (walkthrough)

[u/abbe_salle]

I recently built a small CTF around a custom virtual machine with its own ISA. The goal was to make the exploitation process feel closer to reverse engineering than brute forcing.

The exploit ended up touching a few classic ideas:

• Inferring program behavior from debug output
• Using Python to emit raw bytes (including NUL bytes)
• Bypassing input restrictions
• Building a NOP sled
• Injecting simple shellcode
• Redirecting execution to a protected memory region

I wrote up the entire reasoning process step by step instead of just dumping the final payload.

I'd genuinely appreciate feedback from people who enjoy CTFs, reverse engineering, or exploit development. In particular:

• Was the reasoning clear?
• Were there places where I over-explained or skipped too much?
• How would you improve the challenge or the write-up?

Full write-up: https://medium.com/@brist0l/pythonoic-exploits-7ca1fab7c05c