Question $4$

In the TCache bins double$-$free attack, suppose at the beginning the TCache bins are empty.

Then we allocate a small chunk of $8$ bytes and heap layout is: pwndbg$>$ vis$\_$heap$\_$chunks $...$

Top chunk

Then, we free this chunk twice.

The bin chunk size it falls in is:

bytes

$($Please fill in with a string starting with $\backslash (0$ x $\backslash )$ and then $2$ digit$-$hexadecimal$)$

After these two free operations, the content of the first eight bytes in data section of the chunk is:

$($Please fill in with a string starting with $\backslash (0$ x $\backslash )$ and then $6$ digit$-$hexadecimal$)$ The content of the second eight bytes in data section of the chunk is:

$($Please fill in with a string starting with $\backslash (0$ x $\backslash )$ and then $1$ digit$-$hexadecimal$)$ The beginning address of the chunk is:

$($Please fill in with a string starting with $\backslash (0$ x $\backslash )$ and then $6$ digit$-$hexadecimal$)$ The content of the first $8$ bytes of the whole chunk is:

$($Please fill in with a string starting with $\backslash (0$ x $\backslash )$ and then $1$ digit$-$hexadecimal$)$ The content of the second $8$ bytes of the whole chunk is:

$($Please fill in with a string starting with $\backslash (0$ x $\backslash )$ and then $2$ digit$-$hexadecimal$)$