non_perfect_guesser

spbctf

Task: glibc 2.31 malloc-predictor pwn that dumps main_arena and the tcache_perthread_struct each round and asks you to predict the exact pointer malloc(size) will return, 42 times, to get cat /flag. Solution: because glibc 2.31 has no safe-linking, every tcache/fastbin fd is a raw address, so the full allocator state is disclosed; reimplement the _int_malloc allocation priority (tcache head -> fastbin -> smallbin bk -> unsorted/top) from the dumped structs to answer every round deterministically with zero memory corruption.