@yuvalof and I solved RIDL during #GoogleCTF for @pastenctf. Here's our solution. github.com/oranav/ctf-writeu… ... I still don't know exactly why it works though :-)