Heap Exploitation Part 3
A heap overflow walked from the bug to a heap-resident function pointer, and why a partial pointer overwrite is enough.
#Reversing
Heap Exploitation Part 2
How glibc actually reaches each malloc and free path, and why request size, tcache state and arena state change the route.
Heap Exploitation Part 1
A mental model of the glibc allocator: arenas, chunks, the top chunk and the bins, built before we touch any bug or primitive.