Isaimini.6 ^new^ [ Chrome ]

There is to win from the interpreter – it is only reachable via a function pointer stored in the global variable callback . The pointer is used after the instruction loop finishes:

# Send the payload via stdin printf "$payload" | ./isaimini.6 : isaimini.6

Putting it together (little‑endian encoding for the immediate): There is to win from the interpreter –

if (callback != NULL) ((void (*)(void))callback)(); callback is a global 8‑byte variable at 0x00603010 , initialised to 0 . The only way to set it is through the ST instruction (store to memory). isaimini.6