缓冲区溢出修改返回地址：求正确偏移量与目标函数地址

我最近在做缓冲区溢出的实验，目标是修改返回地址来调用print_good函数，现在卡在了确定正确的十进制偏移量和十六进制目标地址上。之前我试着用objdump计算偏移量，拿输出"Try again"的puts函数地址0x40074e减去print_good的地址0x400686，得到了0xcd，但把这个偏移量和目标地址0x400686组合起来测试后，根本没法触发print_good函数。我觉得print_good的地址0x400686大概率是正确的，但偏移量肯定算错了。

我手头有对应的可执行文件（Ch3_07_CanaryBypass）和C代码，代码如下：

#include <stdio.h>
#include <signal.h>
#include <stdlib.h>
#define USERDEF 30

char msg[] = "Stack canaries and non-executable stacks make stack exploitation difficult. Such\n"
"techniques, however, do not protect against return-oriented programming where\n"
"only the return addresses on the stack are targeted. In this level, you control\n"
"a single write into a vulnerable buffer in the function prompt_user. Overflow\n"
"the buffer to modify the return address beyond the stack canary so that it\n"
"points to a function of your choice. The level will prompt you with an offset\n"
"(in decimal) from the beginning of the buffer that will be written into followed\n"
"by a hexadecimal value that will be written there (e.g. scanf(\"%d %x\");).\n"
"The program will then write the hexadecimal value to a location computed\n"
"using the offset. To determine how close you are, examine the pointer\n"
"being used to write into the stack and how far away it is from the value\n"
"of $rsp when the retq instruction at the end of prompt_user is reached.\n\n";

void print_good() {
    printf("Good Job.\n");
    exit(0);
}

void print_msg() {
    printf("%s",msg);
}

void prompt_user() {
    char buffer[30];
    int offset;
    char *user_addr;
    char **over_addr;

    printf("Enter the password: ");
    scanf("%d %lx", &offset, (unsigned long *) &user_addr);
    over_addr = (char **) (buffer + offset);
    *over_addr = user_addr;
}

int main(int argc, char *argv[]) {
    print_msg();
    prompt_user();
    printf("Try again.\n");
    return 0;
}

有没有大佬能帮我找出正确的偏移量和对应的十六进制地址参数？

内容的提问来源于stack exchange，提问作者Tribunal Homeland