Leaking a Memory Address was the most difficult part! Eventually I realized I could read the Uninitialized padding inside heap allocations. Through heap manipulation this value could be a Pointer By overwriting the lowest byte with 00000101 the Pointer would be read as a Float

0 likes 1 replies