ethernaut foundry solidity blockchain HTB egg_hunting fmtstr aaw OOB exit_hook 整数溢出 qiling random csu 侧信道 非预期 cpp IO_FILE house of orange 格式化字符串 unlink 栈迁移 fuzz aarch64 异构 mips scanf绕过 orw SROP PWN CTF DVRF cve 逻辑漏洞 tcachebin attack partial write 文件描述符 非栈上格式化字符串 awd 整型溢出 double free 指针 proxy house of apple chunk overlapping _IO_FILE largebin attack 堆风水 _IO_2_1_stdout setcontext 堆上rop unsortedbin attack 2.32 uaf 堆栈结合rop 2.34 fastbin attack 堆上orw tcachebin struct 劫持vtable IO realloc shellcode ISCC fmtarg house of force 堆 伪随机 ROP 劫持got表 off by one 栈 canary pipe tcache_struct realloc_hook Re WEB 长度绕过 ret2libc 堆溢出 静态编译 系统调用 虚函数 stack smash ret2text nx pie 机器码 hw 数据结构