I have been struggling with the challenge, where I am suppose to inject a shellcode with only 18 bytes, to read the "/flag" and send to stdout. The mmap location the challenge is set to RE only, so I cannot directly send stage 2 into the memory, and also the stack is NX. I tried to do mprotect syscall, to unlock the page, but it will take 13 bytes...