Tokyohot N0541 -

$ ./n0541 1) Register > 1 Name: AAAAA... Password: BBBBB... [debug] pwd ptr = 0x603090 The global logged_in lives at 0x603200 . The distance is:

def menu(s): recvuntil(s, b'> ')

To confirm this, I printed the address of user->pwd after registration: tokyohot n0541