Message System

struct msg { char *buf; size_t len; };
void show(struct msg *m) { write(1, m->buf, m->len); }

from pwn import *
io = process("./chall")
base = leak - offset
win = base + 0x21BE

mov rdi, rax
call puts

pwndbg> x/4gx 0x555555559290
0x555555559290: 0x0000000000000000 0x0000000000000021