A format string leak, a UAF heap leak, and a House of Force attack to pop a shell in the ROMHack CTF Swordmaster pwn challenge.