#!/usr/bin/env python 
from pwn import *

LOCAL  = True
Debug  = True
SERVER = '172.16.113.50'
PORT   = 11020
Binary = 'tachikoma'

def L(msg):
    if Debug:
        print msg

if not LOCAL:
    r = remote(SERVER, PORT)
else:
    r = process('./{}'.format(Binary))
    L(r.proc.pid)
    a = raw_input('Wait gdb attach...\n')



# echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
# echo 2 | sudo tee /proc/sys/kernel/randomize_va_space

memcpy = """

b *0x56560aaf
b *0x5656895b  (function name ?)
b *0x56563f69  (function content ?)
"""

write = """
b *0x565563d0
"""

"""
malloc length
memcpy function name

"""

if __name__ == "__main__":





    r.interactive()
