For Level-3 attack, during the debugging process, find the address for $rbp instead of $ebp.
(Open the image in a new tab to enlarge it)