•Part 8: The memory location we wish to overwrite, -2
–This becomes the new second chunk’s forward pointer
–The value we put there is the location of the free() function call-12
–From our example 0x08049548 – 0xc
•Part 9: The value to overwrite
–This becomes the new second chunk’s backward pointer
–This points to our shellcode
–From our example this is 0x08049560
•Part 10: NULL terminate the string (\x0)