tcache_perthread_struct hijack 2025-7-23 17:32 | 102 | 0 | Notes-pwn 2.39 malloc.c 中的源代码: typedef struct tcache_entry{ struct tcache_entry *next; /* This field exists to detect double frees. */ uintptr_t key; // uintptr_t 就是 unsigned int,2.2… tcache堆利用