fix source language

2020/3kctf/babym1ps/README.md

@@ -22,7 +22,7 @@ you can manually reverse for the password, it's not super complicated but just t
 with using angr, i used angr.
 
 
-```
+```python
 # idk what this is, it's not important
 p.hook(0x00400550, angr.SIM_PROCEDURES["stubs"]["Nop"]())
 # shim other functions
@@ -47,7 +47,7 @@ main based on the parameters and how they're used. i also recorded the values re
 of PRNG, probably `rand()` during a concrete execution and added a custom SimProcedure for that. the
 rest is straightforward
 
-```
+```python
 # call main
 st = p.factory.call_state(0x004005e0)
 sm = p.factory.simulation_manager(st)
@@ -62,7 +62,7 @@ be leaked by the `printf()` call for the username, since that will keep printing
 a null byte. the LSB of the cookie is always null, but by providing an overwrite of 1 char into the
 cookie we can leak the whole thing. just remember to set the null back with the next overwrite.
 
-```
+```python
 log.info("performing stack leak")
 p.send("A" * 129)
 name = p.recvuntil("your pass")
@@ -134,7 +134,7 @@ now it turns out the challenge author did it in 3 gadgets but weh. this also wor
 
 and here's the code
 
-```
+```python
 log.info("performing attack")
 
 pwd = b"dumbasspassword"
@@ -180,3 +180,12 @@ were run on a real MIPS board).
 
 the typical mitigation for this is to add additional ROP steps to call `sleep()` with a small value
 -- kernel context switching will flush the caches and then you'll be all set.
+
+## last word
+
+it's kinda ironic to me how the challenge is named such that it appears to be a `baby`-type
+challenge but then it also only got 3 solves. i wouldn't say it's not fairly straightforward once
+you get into it, but for me personally having to find gadgets by hand was a major time sink, and it
+sucks that the ghidra scripts mostly failed to find stuff even though there _are_ lots of useful
+gadgets in the binary. i mean c'mon it's static libc, of course there are useful gadgets.  
+🦈✨