pwn7 hardened_calc (HARDENED Calculator)

pwn_spbctf

Task: hardened variant of an mc4-family menu Calculator (NON-PIE, canary, NX) where the original boundary bug is fixed but option d (delete) shrinks the number buffer without re-clamping stored start/end indices. Solution: stale boundaries drive an OOB heap read over a recycled tcache slot reaching the separate flag chunk; recover bytes via cumulative-sum differencing of Sum results across a stable count==2 buffer.