Here my solution for the "inst_prof" pwnable using radare2, IDA Pro, pwntools and more: [https://dilsec.com/2017/07/09/google-ctf-inst_prof-v2-keeping-it-simple/](https://dilsec.com/2017/07/09/google-ctf-inst_prof-v2-keeping-it-simple/)