In our heap overflow attack on fast bins in the lecture, we have first few steps using unsorted bins to compute libc base address. The unsorted bins layout in the first few steps is as follows:
(1)
The heap overflow attack on fast bins is still feasible without the first few steps using unsorted bins to compute libc base address, as long as, say, we somehow know the address of __malloc_hook variable.
[ Select ] ["False", "True"]
(2)
The heap overflow attack on fast bins is still feasible without the first few steps using unsorted bins to compute libc base address, as long as, say, we somehow know the address of __realloc_hook variable and decide to use realloc to trigger the control flow hijacking instead of calling malloc.
[ Select ] ["True", "False"]