complete intended solution (see code)
* use game of life to leak uninitialized data in stack
* read k1/k2 from cmac
* generate a collision on the last block
* use the circuit generated by the collision to read out of bounds
* read the flag

Original writeup (https://colab.research.google.com/drive/1U7hUaPF9Su-vvdc0kNMDQaNoJargmh67).