pwn7_mc1 (Mic Check — Heap Game)

pwn_spbctf

Task: heap 'game' binary (PIE/NX/canary/Full RELRO) that prints a target pointer each round and lets you pick the malloc size; landing the second malloc(0x10) on the target 10 times wins. Solution: ignore the srand(time) PRNG entirely — the target is leaked directly, so solve by pure glibc chunk-size arithmetic: size = (target - prev_ptr - 0x20) - 8 makes the bump allocator land exactly on target.